CNT 与 CCR1 比较
  -> OC1REF
  -> 死区生成器
  -> CC1P/CC1NP 极性与 CC1E/CC1NE 通道许可
  -> 受 BDTR.MOE、OSSI/OSSR 等控制的输出使能电路
  -> TIM1_CH1 / TIM1_CH1N 引脚复用

外部故障源
  -> 板级电气网络
  -> 合法 TIM1_BKIN 复用输入
  -> BDTR.BKE/BKP 判定有效
  -> 硬件清除/压制 MOE，输出进入配置的 off/idle 状态
  -> SR.BIF 记录事件
  -> 可选 DIER.BIE -> NVIC -> HAL_TIM_IRQHandler
  -> HAL_TIMEx_BreakCallback 只做诊断与恢复决策

当前主侧许可
  -> 比较参考要求切到互补侧
  -> 立即撤销主侧许可
  -> 两侧都不许可，持续 dead time
  -> 允许互补侧

0xx: DT = DTG[7:0] * tDTS
10x: DT = (64 + DTG[5:0]) * 2 * tDTS
110: DT = (32 + DTG[4:0]) * 8 * tDTS
111: DT = (32 + DTG[4:0]) * 16 * tDTS

AutomaticOutput = DISABLE
break -> 硬件关输出 -> 软件锁存故障
-> 上层确认故障源已解除
-> 清诊断/标志 -> 显式重新置 MOE

固定完整 MCU/封装和原理图
  -> 证明 CH1、CH1N、BKIN 的合法复用与外部极性
  -> 先让外部功率级保持禁用
  -> 配置系统时钟与 APB2
  -> 独占 TIM1，门控时钟并执行一次受控复位
  -> GPIO 先处于板级定义的安全状态，再切到 AF
  -> 配置 PSC/ARR/RCR/CKD 与 PWM1/CCR1/极性/idle state
  -> 配置 DTG、BKE/BKP、OSSI/OSSR、AOE、LOCK
  -> 清 BIF，按需开启 BIE/NVIC
  -> 启动 CH1 与 CH1N
  -> 读回关键寄存器
  -> 只有板级安全检查通过后，才由板级代码决定是否使能外部驱动器

BKIN 有效
  -> 硬件安全链关闭输出许可并置 BIF
  -> 功率级结果取决于 off/idle、电气网络和驱动器
  -> 可选 break IRQ 到达 CPU
  -> HAL 清 BIF 后调用 HAL_TIMEx_BreakCallback
  -> callback 只保存首个故障、计数和寄存器快照
  -> 应用禁止自动恢复，等待板级故障源确认

HSI = 16 MHz
  -> PLLM = 16, PLLN = 336, PLLP = 2
  -> SYSCLK = 168 MHz
  -> AHB prescaler /1
  -> HCLK = 168 MHz
  -> APB2 prescaler /2
  -> PCLK2 = 84 MHz
  -> F407 规则：APB2 prescaler != 1
  -> TIM1 kernel clock = 2 * PCLK2 = 168 MHz
  -> RCC_APB2ENR.TIM1EN 门控
  -> RCC_APB2RSTR.TIM1RST 受控复位后释放
  -> CR1.CKD = DIV1，tDTS = 1 / 168 MHz ~= 5.952 ns
  -> PSC = 0，ARR = 8399，edge-aligned upcount
  -> PWM = 168 MHz / ((0 + 1) * (8399 + 1)) = 20 kHz
  -> CCR1 = 4200，参考占空关系约 50%
  -> DTG = 84，名义 dead time = 84 * tDTS = 500 ns

/* safe_pwm_fake_test.c: Host Fake only; not STM32 hardware evidence. */
#include <assert.h>
#include <stdint.h>
#include <stdio.h>

typedef enum {
    SAFE_PWM_SIDE_OFF = 0,
    SAFE_PWM_SIDE_MAIN = 1,
    SAFE_PWM_SIDE_COMPLEMENT = 2
} safe_pwm_side_t;

typedef enum {
    SAFE_PWM_OK = 0,
    SAFE_PWM_ERR_ARGUMENT = 1,
    SAFE_PWM_ERR_NOT_ARMED = 2,
    SAFE_PWM_ERR_FAULT_LATCHED = 3,
    SAFE_PWM_ERR_BREAK_ACTIVE = 4,
    SAFE_PWM_ERR_LOCKED = 5
} safe_pwm_result_t;

typedef enum {
    SAFE_PWM_FAULT_NONE = 0,
    SAFE_PWM_FAULT_BREAK = 1,
    SAFE_PWM_FAULT_INVARIANT = 2
} safe_pwm_fault_t;

typedef struct {
    uint32_t dead_ticks;
} safe_pwm_config_t;

typedef struct {
    safe_pwm_config_t config;
    safe_pwm_side_t pending_side;
    safe_pwm_fault_t first_fault;
    uint32_t dead_ticks_left;
    uint32_t compare_events;
    uint32_t break_events;
    uint8_t configured;
    uint8_t running;
    uint8_t moe;
    uint8_t main_on;
    uint8_t complement_on;
    uint8_t break_active;
    uint8_t locked;
} safe_pwm_t;

static uint8_t safe_pwm_invariant(const safe_pwm_t *self)
{
    return (uint8_t)!((self->main_on != 0U) &&
                      (self->complement_on != 0U));
}

static safe_pwm_result_t safe_pwm_init(safe_pwm_t *self,
                                       const safe_pwm_config_t *config)
{
    if ((self == NULL) || (config == NULL) ||
        (config->dead_ticks == 0U)) {
        return SAFE_PWM_ERR_ARGUMENT;
    }

    *self = (safe_pwm_t){0};
    self->config = *config;
    self->configured = 1U;
    return SAFE_PWM_OK;
}

static safe_pwm_result_t safe_pwm_arm(safe_pwm_t *self)
{
    if ((self == NULL) || (self->configured == 0U)) {
        return SAFE_PWM_ERR_ARGUMENT;
    }
    if (self->locked != 0U) {
        return SAFE_PWM_ERR_LOCKED;
    }
    if (self->first_fault != SAFE_PWM_FAULT_NONE) {
        return SAFE_PWM_ERR_FAULT_LATCHED;
    }
    if (self->break_active != 0U) {
        return SAFE_PWM_ERR_BREAK_ACTIVE;
    }

    self->main_on = 0U;
    self->complement_on = 0U;
    self->pending_side = SAFE_PWM_SIDE_OFF;
    self->dead_ticks_left = 0U;
    self->running = 1U;
    self->moe = 1U;
    return SAFE_PWM_OK;
}

static safe_pwm_result_t safe_pwm_compare_event(safe_pwm_t *self,
                                                safe_pwm_side_t requested)
{
    if ((self == NULL) || (requested > SAFE_PWM_SIDE_COMPLEMENT)) {
        return SAFE_PWM_ERR_ARGUMENT;
    }
    if (self->first_fault != SAFE_PWM_FAULT_NONE) {
        return SAFE_PWM_ERR_FAULT_LATCHED;
    }
    if ((self->running == 0U) || (self->moe == 0U)) {
        return SAFE_PWM_ERR_NOT_ARMED;
    }

    self->compare_events++;
    self->main_on = 0U;
    self->complement_on = 0U;
    self->pending_side = requested;
    self->dead_ticks_left = (requested == SAFE_PWM_SIDE_OFF)
                                ? 0U
                                : self->config.dead_ticks;
    return SAFE_PWM_OK;
}

static void safe_pwm_deadtime_tick(safe_pwm_t *self)
{
    if ((self == NULL) || (self->running == 0U) ||
        (self->moe == 0U) || (self->dead_ticks_left == 0U)) {
        return;
    }

    self->dead_ticks_left--;
    if (self->dead_ticks_left == 0U) {
        self->main_on = (uint8_t)(self->pending_side == SAFE_PWM_SIDE_MAIN);
        self->complement_on =
            (uint8_t)(self->pending_side == SAFE_PWM_SIDE_COMPLEMENT);
    }

    if (safe_pwm_invariant(self) == 0U) {
        self->main_on = 0U;
        self->complement_on = 0U;
        self->moe = 0U;
        if (self->first_fault == SAFE_PWM_FAULT_NONE) {
            self->first_fault = SAFE_PWM_FAULT_INVARIANT;
        }
    }
}

static void safe_pwm_break_event(safe_pwm_t *self)
{
    if (self == NULL) {
        return;
    }
    self->break_active = 1U;
    self->break_events++;
    self->moe = 0U;
    self->main_on = 0U;
    self->complement_on = 0U;
    self->pending_side = SAFE_PWM_SIDE_OFF;
    self->dead_ticks_left = 0U;
    if (self->first_fault == SAFE_PWM_FAULT_NONE) {
        self->first_fault = SAFE_PWM_FAULT_BREAK;
    }
}

static void safe_pwm_set_break_level(safe_pwm_t *self, uint8_t active)
{
    if (self != NULL) {
        self->break_active = (uint8_t)(active != 0U);
    }
}

static safe_pwm_result_t safe_pwm_acknowledge(safe_pwm_t *self)
{
    if (self == NULL) {
        return SAFE_PWM_ERR_ARGUMENT;
    }
    if (self->break_active != 0U) {
        return SAFE_PWM_ERR_BREAK_ACTIVE;
    }
    if (self->locked != 0U) {
        return SAFE_PWM_ERR_LOCKED;
    }

    self->first_fault = SAFE_PWM_FAULT_NONE;
    return safe_pwm_arm(self);
}

int main(void)
{
    safe_pwm_t pwm;
    const safe_pwm_config_t config = {
        .dead_ticks = 2U
    };

    assert(safe_pwm_init(&pwm, &config) == SAFE_PWM_OK);
    assert(safe_pwm_compare_event(&pwm, SAFE_PWM_SIDE_MAIN) ==
           SAFE_PWM_ERR_NOT_ARMED);
    assert(safe_pwm_arm(&pwm) == SAFE_PWM_OK);

    assert(safe_pwm_compare_event(&pwm, SAFE_PWM_SIDE_MAIN) == SAFE_PWM_OK);
    assert((pwm.main_on == 0U) && (pwm.complement_on == 0U));
    safe_pwm_deadtime_tick(&pwm);
    assert((pwm.main_on == 0U) && (pwm.complement_on == 0U));
    safe_pwm_deadtime_tick(&pwm);
    assert((pwm.main_on == 1U) && (pwm.complement_on == 0U));

    assert(safe_pwm_compare_event(&pwm, SAFE_PWM_SIDE_COMPLEMENT) ==
           SAFE_PWM_OK);
    assert((pwm.main_on == 0U) && (pwm.complement_on == 0U));
    safe_pwm_deadtime_tick(&pwm);
    safe_pwm_deadtime_tick(&pwm);
    assert((pwm.main_on == 0U) && (pwm.complement_on == 1U));

    safe_pwm_break_event(&pwm);
    assert((pwm.moe == 0U) && (pwm.main_on == 0U) &&
           (pwm.complement_on == 0U));
    assert(pwm.first_fault == SAFE_PWM_FAULT_BREAK);
    assert(safe_pwm_acknowledge(&pwm) == SAFE_PWM_ERR_BREAK_ACTIVE);

    safe_pwm_set_break_level(&pwm, 0U);
    assert(safe_pwm_acknowledge(&pwm) == SAFE_PWM_OK);
    assert(safe_pwm_invariant(&pwm) != 0U);

    puts("safe_pwm_fake: PASS");
    return 0;
}

cc -std=c11 -Wall -Wextra -Werror -pedantic safe_pwm_fake_test.c -o safe_pwm_fake_test
./safe_pwm_fake_test

/* bsp_safe_pwm.h: reference implementation, not compiled in this run. */
#ifndef BSP_SAFE_PWM_H
#define BSP_SAFE_PWM_H

#include <stdint.h>

typedef enum {
    BSP_SAFE_PWM_OK = 0,
    BSP_SAFE_PWM_ERR_ARGUMENT = 1,
    BSP_SAFE_PWM_ERR_HAL_INIT = 2,
    BSP_SAFE_PWM_ERR_HAL_CHANNEL = 3,
    BSP_SAFE_PWM_ERR_HAL_BDTR = 4,
    BSP_SAFE_PWM_ERR_HAL_START_MAIN = 5,
    BSP_SAFE_PWM_ERR_HAL_START_N = 6,
    BSP_SAFE_PWM_ERR_BREAK_ACTIVE = 7,
    BSP_SAFE_PWM_ERR_MOE_REJECTED = 8,
    BSP_SAFE_PWM_ERR_FAULT_LATCHED = 9
} bsp_safe_pwm_result_t;

typedef struct {
    uint32_t timer_clock_hz;
    uint32_t prescaler;
    uint32_t period;
    uint32_t pulse;
    uint32_t dead_time_code;
    uint32_t break_polarity;
} bsp_safe_pwm_config_t;

typedef struct {
    uint32_t break_events;
    uint32_t hal_errors;
    uint32_t first_fault;
    uint32_t bdtr_at_break;
    uint8_t running;
    uint8_t fault_latched;
} bsp_safe_pwm_diag_t;

bsp_safe_pwm_result_t BSP_SafePwm_Init(const bsp_safe_pwm_config_t *config);
bsp_safe_pwm_result_t BSP_SafePwm_Start(void);
void BSP_SafePwm_Stop(void);
bsp_safe_pwm_result_t BSP_SafePwm_RecoverAfterBreak(void);
void BSP_SafePwm_GetDiag(bsp_safe_pwm_diag_t *out);

#endif

/* board_tim1.c: the real board must implement these three functions. */
#include <stdint.h>

void Board_TIM1_GpioInitSafe(void);
uint8_t Board_TIM1_BreakIsInactive(void);
void Board_PowerStage_KeepDisabled(void);

/* bsp_safe_pwm.c: STM32F407xx reference, pending target build/validation. */
#include "bsp_safe_pwm.h"
#include "stm32f4xx_hal.h"

extern void Board_TIM1_GpioInitSafe(void);
extern uint8_t Board_TIM1_BreakIsInactive(void);
extern void Board_PowerStage_KeepDisabled(void);

enum {
    BSP_FAULT_NONE = 0U,
    BSP_FAULT_BREAK = 1U,
    BSP_FAULT_HAL = 2U
};

static TIM_HandleTypeDef g_htim1;
static volatile bsp_safe_pwm_diag_t g_diag;
static uint8_t g_main_started;
static uint8_t g_n_started;

static void bsp_record_first_fault(uint32_t fault)
{
    if (g_diag.first_fault == BSP_FAULT_NONE) {
        g_diag.first_fault = fault;
    }
    g_diag.fault_latched = 1U;
}

static void bsp_record_hal_fault(void)
{
    g_diag.hal_errors++;
    bsp_record_first_fault(BSP_FAULT_HAL);
}

static void bsp_force_outputs_off(void)
{
    __HAL_TIM_MOE_DISABLE(&g_htim1);
    g_diag.running = 0U;
}

bsp_safe_pwm_result_t BSP_SafePwm_Init(const bsp_safe_pwm_config_t *config)
{
    TIM_OC_InitTypeDef oc = {0};
    TIM_BreakDeadTimeConfigTypeDef bdtr = {0};

    if ((config == NULL) || (config->timer_clock_hz == 0U) ||
        (config->period == 0U) || (config->pulse > config->period) ||
        (config->dead_time_code > 0xFFU) ||
        ((config->break_polarity != TIM_BREAKPOLARITY_LOW) &&
         (config->break_polarity != TIM_BREAKPOLARITY_HIGH))) {
        return BSP_SAFE_PWM_ERR_ARGUMENT;
    }

    Board_PowerStage_KeepDisabled();
    HAL_NVIC_DisableIRQ(TIM1_BRK_TIM9_IRQn);
    __HAL_RCC_TIM1_CLK_ENABLE();
    __HAL_RCC_TIM1_FORCE_RESET();
    __HAL_RCC_TIM1_RELEASE_RESET();
    Board_TIM1_GpioInitSafe();

    g_htim1 = (TIM_HandleTypeDef){0};
    g_diag = (bsp_safe_pwm_diag_t){0};
    g_main_started = 0U;
    g_n_started = 0U;
    g_htim1.Instance = TIM1;
    g_htim1.Init.Prescaler = config->prescaler;
    g_htim1.Init.CounterMode = TIM_COUNTERMODE_UP;
    g_htim1.Init.Period = config->period;
    g_htim1.Init.ClockDivision = TIM_CLOCKDIVISION_DIV1;
    g_htim1.Init.RepetitionCounter = 0U;
    g_htim1.Init.AutoReloadPreload = TIM_AUTORELOAD_PRELOAD_ENABLE;

    if (HAL_TIM_PWM_Init(&g_htim1) != HAL_OK) {
        bsp_record_hal_fault();
        return BSP_SAFE_PWM_ERR_HAL_INIT;
    }

    oc.OCMode = TIM_OCMODE_PWM1;
    oc.Pulse = config->pulse;
    oc.OCPolarity = TIM_OCPOLARITY_HIGH;
    oc.OCNPolarity = TIM_OCNPOLARITY_HIGH;
    oc.OCFastMode = TIM_OCFAST_DISABLE;
    oc.OCIdleState = TIM_OCIDLESTATE_RESET;
    oc.OCNIdleState = TIM_OCNIDLESTATE_RESET;
    if (HAL_TIM_PWM_ConfigChannel(&g_htim1, &oc, TIM_CHANNEL_1) != HAL_OK) {
        bsp_record_hal_fault();
        return BSP_SAFE_PWM_ERR_HAL_CHANNEL;
    }

    bdtr.OffStateRunMode = TIM_OSSR_DISABLE;
    bdtr.OffStateIDLEMode = TIM_OSSI_DISABLE;
    bdtr.LockLevel = TIM_LOCKLEVEL_OFF;
    bdtr.DeadTime = config->dead_time_code;
    bdtr.BreakState = TIM_BREAK_ENABLE;
    bdtr.BreakPolarity = config->break_polarity;
    bdtr.BreakFilter = 0U; /* F4 v1.28.3 does not apply this field here. */
    bdtr.AutomaticOutput = TIM_AUTOMATICOUTPUT_DISABLE;
    if (HAL_TIMEx_ConfigBreakDeadTime(&g_htim1, &bdtr) != HAL_OK) {
        bsp_record_hal_fault();
        return BSP_SAFE_PWM_ERR_HAL_BDTR;
    }

    __HAL_TIM_MOE_DISABLE(&g_htim1);
    if (Board_TIM1_BreakIsInactive() == 0U) {
        bsp_record_first_fault(BSP_FAULT_BREAK);
        return BSP_SAFE_PWM_ERR_BREAK_ACTIVE;
    }
    __HAL_TIM_CLEAR_FLAG(&g_htim1, TIM_FLAG_BREAK);
    if (__HAL_TIM_GET_FLAG(&g_htim1, TIM_FLAG_BREAK) != RESET) {
        bsp_record_first_fault(BSP_FAULT_BREAK);
        return BSP_SAFE_PWM_ERR_BREAK_ACTIVE;
    }
    __HAL_TIM_ENABLE_IT(&g_htim1, TIM_IT_BREAK);
    HAL_NVIC_SetPriority(TIM1_BRK_TIM9_IRQn, 5U, 0U);
    HAL_NVIC_ClearPendingIRQ(TIM1_BRK_TIM9_IRQn);
    HAL_NVIC_EnableIRQ(TIM1_BRK_TIM9_IRQn);

    return BSP_SAFE_PWM_OK;
}

bsp_safe_pwm_result_t BSP_SafePwm_Start(void)
{
    if (Board_TIM1_BreakIsInactive() == 0U) {
        bsp_record_first_fault(BSP_FAULT_BREAK);
        return BSP_SAFE_PWM_ERR_BREAK_ACTIVE;
    }
    if (g_diag.fault_latched != 0U) {
        return BSP_SAFE_PWM_ERR_FAULT_LATCHED;
    }

    /* HAL start calls are sequential, not an atomic pair-enable operation.
       The external power stage must remain disabled during this step. */
    if (HAL_TIM_PWM_Start(&g_htim1, TIM_CHANNEL_1) != HAL_OK) {
        bsp_force_outputs_off();
        bsp_record_hal_fault();
        return BSP_SAFE_PWM_ERR_HAL_START_MAIN;
    }
    g_main_started = 1U;

    if (HAL_TIMEx_PWMN_Start(&g_htim1, TIM_CHANNEL_1) != HAL_OK) {
        bsp_force_outputs_off();
        (void)HAL_TIM_PWM_Stop(&g_htim1, TIM_CHANNEL_1);
        g_main_started = 0U;
        bsp_record_hal_fault();
        return BSP_SAFE_PWM_ERR_HAL_START_N;
    }
    g_n_started = 1U;
    g_diag.running = 1U;
    return BSP_SAFE_PWM_OK;
}

void BSP_SafePwm_Stop(void)
{
    bsp_force_outputs_off();
    if (g_n_started != 0U) {
        (void)HAL_TIMEx_PWMN_Stop(&g_htim1, TIM_CHANNEL_1);
        g_n_started = 0U;
    }
    if (g_main_started != 0U) {
        (void)HAL_TIM_PWM_Stop(&g_htim1, TIM_CHANNEL_1);
        g_main_started = 0U;
    }
}

bsp_safe_pwm_result_t BSP_SafePwm_RecoverAfterBreak(void)
{
    if (Board_TIM1_BreakIsInactive() == 0U) {
        return BSP_SAFE_PWM_ERR_BREAK_ACTIVE;
    }
    if ((g_main_started == 0U) || (g_n_started == 0U)) {
        return BSP_SAFE_PWM_ERR_MOE_REJECTED;
    }

    __HAL_TIM_MOE_DISABLE(&g_htim1);
    __HAL_TIM_CLEAR_FLAG(&g_htim1, TIM_FLAG_BREAK);
    __HAL_TIM_MOE_ENABLE(&g_htim1);
    __NOP(); /* RM0090: allow MOE write/read synchronization. */
    if ((g_htim1.Instance->BDTR & TIM_BDTR_MOE) == 0U) {
        bsp_record_first_fault(BSP_FAULT_BREAK);
        return BSP_SAFE_PWM_ERR_MOE_REJECTED;
    }

    g_diag.fault_latched = 0U;
    g_diag.first_fault = BSP_FAULT_NONE;
    g_diag.running = 1U;
    return BSP_SAFE_PWM_OK;
}

void BSP_SafePwm_GetDiag(bsp_safe_pwm_diag_t *out)
{
    uint32_t primask;

    if (out == NULL) {
        return;
    }

    primask = __get_PRIMASK();
    __disable_irq();
    out->break_events = g_diag.break_events;
    out->hal_errors = g_diag.hal_errors;
    out->first_fault = g_diag.first_fault;
    out->bdtr_at_break = g_diag.bdtr_at_break;
    out->running = g_diag.running;
    out->fault_latched = g_diag.fault_latched;
    if (primask == 0U) {
        __enable_irq();
    }
}

void HAL_TIMEx_BreakCallback(TIM_HandleTypeDef *htim)
{
    if ((htim != NULL) && (htim->Instance == TIM1)) {
        g_diag.break_events++;
        g_diag.bdtr_at_break = htim->Instance->BDTR;
        bsp_record_first_fault(BSP_FAULT_BREAK);
        g_diag.running = 0U;
    }
}

void HAL_TIM_ErrorCallback(TIM_HandleTypeDef *htim)
{
    if ((htim != NULL) && (htim->Instance == TIM1)) {
        bsp_force_outputs_off();
        bsp_record_hal_fault();
    }
}

void TIM1_BRK_TIM9_IRQHandler(void)
{
    /* This reference assumes TIM9 is disabled. If TIM9 is used, dispatch its
       pending source here as well because the vector is shared. */
    if ((__HAL_TIM_GET_FLAG(&g_htim1, TIM_FLAG_BREAK) != RESET) &&
        (__HAL_TIM_GET_IT_SOURCE(&g_htim1, TIM_IT_BREAK) != RESET)) {
        HAL_TIM_IRQHandler(&g_htim1);
    }
}

/* main.c: reference usage; power stage remains disabled. */
#include "bsp_safe_pwm.h"
#include "stm32f4xx_hal.h"

int main(void)
{
    bsp_safe_pwm_diag_t diag;
    const bsp_safe_pwm_config_t pwm = {
        .timer_clock_hz = 168000000U,
        .prescaler = 0U,
        .period = 8399U,
        .pulse = 4200U,
        .dead_time_code = 84U,
        .break_polarity = TIM_BREAKPOLARITY_HIGH /* board must confirm */
    };

    HAL_Init();
    SystemClock_Config(); /* must produce and document the reference clock */

    if (BSP_SafePwm_Init(&pwm) != BSP_SAFE_PWM_OK) {
        Error_Handler();
    }
    if (BSP_SafePwm_Start() != BSP_SAFE_PWM_OK) {
        Error_Handler();
    }

    for (;;) {
        BSP_SafePwm_GetDiag(&diag);
        if (diag.fault_latched != 0U) {
            /* Keep the power stage disabled; inspect and explicitly recover. */
        }
    }
}

TIM_OC_InitTypeDef oc = {0};
TIM_BreakDeadTimeConfigTypeDef bdtr = {0};

oc.OCMode = TIM_OCMODE_PWM1;
oc.Pulse = 4200U;
oc.OCPolarity = TIM_OCPOLARITY_HIGH;
oc.OCNPolarity = TIM_OCNPOLARITY_HIGH;
oc.OCIdleState = TIM_OCIDLESTATE_RESET;
oc.OCNIdleState = TIM_OCNIDLESTATE_RESET;
(void)HAL_TIM_PWM_ConfigChannel(&g_htim1, &oc, TIM_CHANNEL_1);

bdtr.DeadTime = 84U; /* encoded DTG, not 84 ns */
bdtr.BreakState = TIM_BREAK_ENABLE;
bdtr.BreakPolarity = TIM_BREAKPOLARITY_HIGH; /* board-dependent */
bdtr.AutomaticOutput = TIM_AUTOMATICOUTPUT_DISABLE;
(void)HAL_TIMEx_ConfigBreakDeadTime(&g_htim1, &bdtr);

(void)HAL_TIM_PWM_Start(&g_htim1, TIM_CHANNEL_1);
(void)HAL_TIMEx_PWMN_Start(&g_htim1, TIM_CHANNEL_1);

CNT 不动
  -> 查 HSI/HSE、PLL、APB2、TIM1EN、TIM1RST、CEN

CNT 动，OC1REF/比较配置不对
  -> 查 PSC/ARR/CCR1、OC1M、preload、UG、生效更新点

内部配置正确，引脚无波形
  -> 查 CC1E/CC1NE、MOE、GPIO AF、封装复用、break 是否一直有效

只有一路有波形
  -> 查 CH1N 是否由目标实例/通道支持、CC1NE、引脚复用、OCN polarity

两路有波形但没有期望死区
  -> 查 TIM1 kernel clock、CKD、DTG 分段、示波器通道/阈值

BKIN 有效但输出不关
  -> 立即保持功率级禁用
  -> 查真实 BKIN 引脚/AF、电平、BKE/BKP、外部网络和 BDTR 读回

输出已关但无 callback
  -> 查 BIF/BIE、NVIC enable/pending、共享向量、ISR 是否调用 HAL handler

故障解除后意外自动恢复
  -> 查 AOE、update event、是否有其他代码写 MOE

normal:
compare -> OC1REF -> dead time -> polarity/channel selection
        -> output-enable circuit controlled by MOE/off-state -> pins

fault:
BKIN -> break logic -> output shutdown + BIF -> optional IRQ -> diagnosis