The certificate, in force space · nine verified slices

The Grasp Certificate

The energy certificate guarantees a body won't diverge. Manipulation needs a different object: a guarantee that the contact force stays inside the friction cone and the grasp holds. This is that certificate — a friction-cone margin at runtime, and the exact grasp-wrench-space quality $Q$ at design time — the point where it says not "grip harder" but "change the grasp," and its slices into the harder frontier: soft, rolling, and genuinely deformable — down to a real FEM body and the viscoelastic material inside it.

Charlot Lab, Institute for Physical AI @ BMI

Draft · 2026-07 · companion to One Energy, Both Roles · every number is a MuJoCo measurement or an exact Ferrari–Canny computation

Runtime friction-cone gate · MuJoCo Exact grasp-wrench-space Q · Ferrari–Canny Deformation port + rolling manifold · first slices Real FEM body + viscoelastic credit Rigid + soft + deformable · in simulation

The Energy First Architecture certifies that a body's action will not diverge — but a grasp can be perfectly non-divergent and still drop the object. Manipulation needs the certificate in force space: the contact force must stay inside the friction cone (no slip) and the grasp must resist any disturbance wrench (force closure). We build that certificate in four self-consistent slices. (1) A runtime gate on the aggregate friction-cone margin $\mu\sum f_n - \sum f_t$, read from the real contact forces, holds a pinched block across a ramping drag where a fixed grip slips — 87% vs 45%, no crush. (2) Probing every direction reveals the grasp's anisotropic wrench envelope: strong on the force axes, weak against a twist about the grip axis. (3) The exact grasp-wrench-space quality $Q$ (Ferrari–Canny) makes that weakness rigorous — a 2-finger pinch is $Q=0$, rank-5, not force closure at all; one off-axis contact makes it $Q=0.14$. (4) The soft-finger torsional term reconciles the measured twist resistance with the point-contact $Q=0$: it gives the pinch a small $Q=0.05$, three times weaker than the third-contact grasp. The certificate becomes a design-time object: $Q=0$ says the grasp geometry cannot be certified — add a contact — not "grip harder." Three further slices carry it into the harder frontier: a soft contact stores strain energy the reported energy is blind to, so a naive barrier certifies a lie of 297 mJ — the fix is one new energy port; force closure is not a snapshot but a function over the roll, and a certificate read at a favorable orientation over-promises by up to 2.4× for an elongated object; and the same deformation that hides energy also buys wrench capacity through the contact patch — a priced tradeoff with an exact scaling law ($Q\!\sim\!F^{1/3}$, $U_c\!\sim\!F^{5/3}$: doubling capacity costs ~32× the stored energy). Two final slices go all the way down to the material: a real FEM body stores 196 mJ of strain the simulator's reported energy shows as zero, and a viscoelastic body relaxes as it is held — so a certificate that knows the relaxed modulus can credit the shrunken reservoir and certify twice the compression within the same recoil budget, when the credit is earned rather than assumed.

1 · Why force space

The energy certificate1 answers "will the closed loop diverge?" — a guarantee in the space of the body's own state. It is silent on the object. A hand can hold its own energy perfectly bounded and still let the cup slip, because whether the cup stays is a question about the contact forces, not the hand's kinetic energy. So manipulation needs a second certificate, over a different object: the contact force must lie inside the Coulomb friction cone at every contact (no slip), the normal force must stay below a crush limit (no damage), and — the strong form — the contacts must jointly resist any external wrench the task or a disturbance applies (force closure). The certificate object is a wrench-space margin, and like the energy certificate it must be checkable before the action commits.

2 · The runtime gate

A two-finger gripper pinches a block; a drag disturbance ramps from zero, trying to pull the block out. The certificate is the aggregate friction-cone margin $m_c=\mu\sum f_n-\sum f_t$, summed over the real MuJoCo contact points (a box-box contact makes many points; slip is governed by the totals, not any single point). A fixed-grip puppet slips the instant the drag exceeds its fixed cone. The agent reads the contact forces, watches the margin thin, and grips harder before the slip — holding a proactive friction reserve.

You pinch a block with a grip (normal) force f_n and pull it sideways with a tangential force f_t. When does it slip?

Friction μ 0.50 Grip / normal force f_n 12.0 N Tangential pull f_t 4.0 N

Interactive figure. The Coulomb friction cone. The contact force (normal f_n + tangential f_t) holds without slip exactly while it stays inside the cone of half-angle arctan μ — i.e. while the margin m_c = μ·f_n − f_t ≥ 0. Drag the pull past the cone edge and the grasp slips. This is the runtime gate, in one contact.

Show the computation

cone half-angle  φ = arctan(μ)
force angle from normal  θ = arctan(f_t / f_n)
holds  ⇔  θ ≤ φ  ⇔  f_t ≤ μ·f_n
margin  m_c = μ·f_n − f_t     (slips when m_c < 0)

controller	grasp held	note
Puppet — fixed grip	45%	slips at drag ≈ 12 N; never saw the boundary
Agent — force-cert gated	87%	no crush; ~2× longer, by gripping before the slip

Two limits surface here and stay true for the whole paper: a purely reactive grip trades a friction reserve (effort) against the crush ceiling — the faster the disturbance, the more reserve it must hold; and once micro-slip begins the object creeps (kinetic $<$ static friction), so a fast ramp's tail is hard to re-catch. Full static holding wants force-closure planning, not only reactive margin-tracking — which is the rest of the paper.

3 · The anisotropic envelope

Resisting one direction is not force closure. Probing disturbance wrenches in several directions and ramping each to failure traces the grasp's certified envelope, and it is sharply anisotropic — exactly as grasp mechanics predicts. Tangent forces are the strong axes (resisted up to the friction cone); an out-of-plane torque is resisted by the finger separation; but a twist about the grip axis is the weak mode — the block spins between the fingers on friction alone. Force-closure quality is the worst direction, and the force-cert agent lifts it: worst-case $Q$ from 0.25 to 0.46. But fighting the twist drives the agent to the crush limit for only partial gain — the first hint that this weakness is not about grip force.

4 · The exact certificate, and the design-time turn

The worst-case margin has an exact form — the Ferrari–Canny quality2. Build the Grasp Wrench Space as the convex hull of the friction-cone generator wrenches $[\,f\,;\,(p\times f)/L\,]$; then $Q$ is the radius of the largest wrench ball centered at the origin that fits inside it, and $Q>0$ iff the grasp is force closure. Computed exactly:

grasp	point contact	soft-finger	verdict
2-finger pinch (collinear)	0	0.049	rank-5 rigid; a weak twist margin with soft fingers
3-finger (+ off-axis thumb)	0.136	0.136	force closure
4-contact (enclosing)	0.249	0.249	stronger closure

The pinch's weakness is now proven, not sampled: with rigid point contact, $p\times f$ for a contact on the grip axis has no component about that axis (max $|\tau_x|=0$ over all its generator wrenches), so the wrench space is rank-5 and $Q=0$ — not force closure, no matter how hard it grips. One off-axis contact makes it full-rank; a fourth nearly doubles $Q$. This is the turn that matters: the certificate is not only a runtime gate but a design-time object. $Q=0$ says the grasp geometry cannot be certified — the fix is to change it, add a contact — and $Q>0$ says it can, and by exactly this margin. It is the rigorous form of "grip harder won't help."

5 · Reconciliation — soft fingers

The rigid result ($Q=0$) and the simulator (which measured a real, if small, twist resistance) look like a contradiction, and resolving it is the paper's internal check. A real fingertip is a soft finger: its contact patch carries not just a force in the cone but a friction moment about the normal, $|m_n|\le\mu_t f_n$. For the pinch the normals are $\pm x$, so that moment is about the grip axis — precisely the weak twist. Adding it (with a physical few-millimetre $\mu_t$) gives the pinch $Q=0.049$: force closure, but a small margin, three times weaker than the third-contact grasp, and unchanged for grasps that are already full-rank. So the pinch's twist resistance comes entirely from soft-finger friction — a weak effect — which is why geometry still dominates and the certificate still says "add a contact." All four slices agree.

6 · Into the deformable and rolling frontier

The rigid certificate rests on two quiet assumptions, and the World-Labs regime — soft, rolling, deformable objects — breaks both. First, that contact stores no energy the barrier can't see. Second, that the contact set the certificate is computed on is the one that holds. Three slices test them.

6.1 · The stored-energy blind spot. A soft contact is a spring: squeezing loads elastic strain energy into it. But even with the simulator's energy accounting on, the reported potential energy does not include contact deformation — so a certificate built on the reported energy is blind to exactly this stored energy. It is a hidden reservoir. A barrier $V(\text{next})\le c$ on the reported energy admits a grasp whose true energy is higher by the whole stored strain: it certifies a lie. And the reservoir is real — snapping the grip open dumps it back into the mechanism as kinetic energy.

holding a 0.30 kg object	naive (grip hard, blind)	aware (deformation port)
stored strain energy $U_c$	296.9 mJ	3.4 mJ
reflected in reported potential	≈ 0 (only −30 mJ, gravity)	≈ 0
⇒ energy the certificate can't see	296.9 mJ	3.4 mJ
finger recoil on release	13.6 mJ	0.8 mJ (17× less)

The fix is one new energy port: the storage function must count the energy the body stores in the object, not only its own. Estimating $U_c$ from contact penetration and force and bounding it — while still meeting the friction-cone reserve — lets the aware grasp grip only as hard as it must, so a release stays gentle. Same one-energy certificate, one extra port. (This is exactly the energy certificate's hardest case, energy-storing contact, meeting the force certificate.)

6.2 · Force closure over the rolling manifold. The exact $Q$ above is a snapshot. Roll the object — in-hand, or against a surface — and the contact points migrate over its surface and the moment arms rotate, so $Q$ is a function of the roll angle, not a number. A grasp certified at one orientation is not certified through the turn. The certificate is $\min_\theta Q(\theta)$ over the swept set, and a snapshot at a favorable orientation over-promises — by an amount that grows with how non-round the object is:

object (aspect)	snapshot Q	min over the roll	over-promise
round (1.0:1)	0.273	0.273	1.00× (invariant — the check)
bar of soap (2.0:1)	0.298	0.195	1.53×
marker (3.0:1)	0.325	0.169	1.93×
pencil (4.0:1)	0.332	0.140	2.38×

The round object is the built-in check: its grasp is genuinely invariant under rolling, so a snapshot loses nothing (1.00×). Everything else over-promises. And the same design-time verdict returns: a third finger both raises the worst-case $Q$ and flattens the swing — for the marker, min-over-roll $Q$ goes $0.169\!\to\!0.276$ and the swing $1.93\times\!\to\!1.15\times$. When the min-over-roll is too low, add a contact; don't grip harder.

6.3 · The deformation tradeoff. Deformation is not only a hazard — it is why a finger grips at all. The same squish that hides energy (6.1) spreads a point contact into a finite patch, and the patch's off-center pressure resists the very twist a point leaves free: a soft pinch has $Q>0$ where the rigid point pinch had $Q=0$. That is the first-principles origin of the soft-finger term of §5 — not a fudge constant but the moment of distributed friction over the patch. So grip force has two opposed effects, and the certificate prices both. The catch is an exact scaling law: capacity grows like the patch radius, $Q\sim F^{1/3}$, while stored energy grows like $U_c\sim F\delta\sim F^{5/3}$.

grip force (Hertzian pad)	patch a	capacity Q	stored $U_c$
10 N	4.83 mm	0.0414	15.5 mJ
80 N (8× the force)	9.65 mm	0.0828 (2×)	497 mJ (32×)

Doubling the certified capacity costs ~32× the stored energy — capacity is cheap to lose and expensive to buy. So the certified operating window (enough patch for the task's $Q$, little enough strain to stay under the energy budget of 6.1) is narrow — for one representative task, grip in $[9.1,\,11.1]$ N — and it is narrow for a principled reason, not a tuning accident. When no grip clears both ledgers, the same verdict holds once more: change the geometry.

7 · All the way down — the material

Slice 6.1 lumped the stored energy at the contact. Does the blind spot survive in a genuine deformable body? We built one — a MuJoCo FEM (flexcomp) block — and measured its strain energy by displacement-controlling both faces (so nothing buckles) and integrating the elastic reaction over the compression. It stores real energy, and the simulator's reported potential does not know:

FEM block, 6 mm compression	value	how
strain energy $\int F\,d\delta$ (independent)	195.7 mJ	work vs a physical, monotonic reaction
reported potential $d.\text{energy}[0]$	0.00 mJ	gravity off ⇒ this is the elastic term

So the blind spot is not an artifact of a lumped model — a full FEM body hides hundreds of mJ of strain from any certificate built on the reported energy. The deformation-port lesson stands at the body level.

7.1 · The viscoelastic credit. A real soft body is not a lossless spring: it is viscoelastic, and that cuts the certificate's way. Modelled as the canonical Standard Linear Solid (an equilibrium spring $k_\infty$ in parallel with a Maxwell arm), it does two things the worst-case bound ignores. A single grip-and-release traces a hysteresis loop the material eats — most near its relaxation rate ($\omega\tau\!\approx\!1$, here up to 75%), little in the slow-elastic or fast-glassy limit. And merely holding relaxes the arm: the recoverable reservoir decays from the instantaneous stored energy toward the equilibrium floor $\tfrac12 k_\infty x^2$.

hold time (relaxation $\tau=0.2$ s)	grip force	recoverable reservoir
0 (instantaneous)	38.4 N	100 mJ
$\tau$ (0.2 s)	20.5 N	34 mJ
$\gg\tau$ (fully relaxed)	10.2 N	25 mJ (4× smaller)

A certificate that knows the relaxed modulus $k_\infty$ and waits out the hold can credit the shrunken reservoir and certify a firmer grip within the very same recoil budget slice 6.1 used — for this material, 2× the compression. But the credit is earned, not assumed, and we state that as loudly as the gain: a fast grab-and-release gives the arm no time to relax (use the worst case); a nearly-elastic material never relaxes (no credit); and the credit needs a certified lower bound on dissipation — an unmeasured material earns nothing. Viscoelasticity is a friend to the certificate only when its loss is itself certified.

Scope. All nine slices are in simulation. Slices 1–5 are rigid objects with Coulomb friction (point and soft-finger); the runtime gate is a proactive reserve, not a proof of static holding under an arbitrary disturbance rate, and the exact $Q$ is the standard convex point-contact model. Slices 6–7 step into the deformable and rolling frontier with deliberately simple models: a soft contact, a quasi-static roll of a smooth convex 2-D object, a Hertzian pad, a MuJoCo FEM block measured through its reaction force, and a lumped linear-viscoelastic material. Those are the right tools for the questions asked — is the energy hidden, how much is recoverable — but not a validated constitutive law. The genuinely open work remains: a spatially-resolved strain-energy field with damage and plasticity (where energy leaves as permanent deformation, not just heat), true rolling-without-slipping constraints, and 3-D roll manifolds. Those are a harder contact model, not a tuning pass — but the certificate's shape now reaches into them: an energy ledger with a deformation port that a viscoelastic material lets you credit down, and a force closure taken as the worst case over the motion, not a snapshot.

References & lineage

Charlot Lab, One Energy, Both Roles and Energy Is the Certificate — the energy certificate this extends into force space.
C. Ferrari & J. Canny, Planning optimal grasps, ICRA 1992 — the grasp-wrench-space quality $Q$ (largest ball in the convex hull of primitive contact wrenches).
H. Hertz, Über die Berührung fester elastischer Körper (1882) — the contact-patch and stored-energy relations used in §6.3, $a=\sqrt{R\delta}$, $U=\tfrac{2}{5}F\delta$.
C. Zener, Elasticity and Anelasticity of Metals (1948) — the Standard Linear Solid used in §7.1 for the relaxation and hysteresis of a viscoelastic body. FEM contact in §7 is MuJoCo's flexcomp (E. Todorov et al., MuJoCo 3.3).
The reproducible probe scripts (runtime gate, wrench-envelope probe, exact/soft-finger $Q$; §6 stored-energy blind spot, rolling-manifold $Q(\theta)$, patch tradeoff; §7 FEM blind-spot and viscoelastic credit) are the Institute's on-device research record. Companion: the Agency Ladder and the J/VT scoreboard.