FaultLatchedPWM
A PWM safety controller whose fault latch lives in RTL — not firmware. Software cannot override what software cannot reach.
Most motor-control safety systems implement their fault logic in a microcontroller: check the duty, refuse if invalid, drive safe. Clean, fast, almost always adequate — until a stack overflow corrupts the check, a priority inversion starves it, or a firmware update reverts it quietly. FaultLatchedPWM moves the safety envelope into the Gowin GW2A-LV18 fabric. A combinational guard module validates period and duty every single clock cycle. Any violation drives output low and latches a five-state FSM into FAULT. The FSM cannot exit FAULT without an externally-asserted recovery sequence. There is no software path to the latch — not because it was removed, but because it was never created.