ERP protocol with sub-ring questions

[UP82]

Hello everybody
i have some question about ERP-protocol
I have the following topology and configuration

Node 1:
#erp service vlan
vlan 10 members linkagg 2-3 tagged
vlan 20 members linkagg 1 tagged

#erp with subring config
erp-ring 1 port1 linkagg 2 port2 linkagg 3 service-vlan 10 level 7
erp-ring 2 sub-ring-port linkagg 1 service-vlan 20 level 7
erp-ring 1 enable
erp-ring 2 enable

Node 2:
vlan 10 members linkagg 2-3 tagged
vlan 20 members linkagg 1 tagged

erp-ring 1 port1 linkagg 2 port2 linkagg 3 service-vlan 10 level 7
erp-ring 2 sub-ring-port linkagg 1 service-vlan 20 level 7
erp-ring 1 enable
erp-ring 2 enable

Questions:
- Does the VLAN 20 (subring) need to pass also in the green (shared link) ? vlan 20 members lingagg3 tagged on both node?
- Whats the use of "protected vlan" command in the ERP configuration? i've didn't understand much from the documentation

thanks a lot