diff --git a/libraries/AP_HAL_ESP32/RCOutput.cpp b/libraries/AP_HAL_ESP32/RCOutput.cpp
index 836a4b1d12..8654ebd652 100644
--- a/libraries/AP_HAL_ESP32/RCOutput.cpp
+++ b/libraries/AP_HAL_ESP32/RCOutput.cpp
@@ -50,6 +50,8 @@ gpio_num_t outputs_pins[] = {};
 #endif
 
 #define MAX_CHANNELS ARRAY_SIZE(outputs_pins)
+static_assert(MAX_CHANNELS < 12, "overrunning _pending and safe_pwm"); // max for current chips
+static_assert(MAX_CHANNELS < 32, "overrunning bitfields");
 
 struct RCOutput::pwm_out RCOutput::pwm_group_list[MAX_CHANNELS];
 
@@ -324,7 +326,7 @@ void RCOutput::force_safety_off(void)
 */
 void RCOutput::set_safety_pwm(uint32_t chmask, uint16_t period_us)
 {
-    for (uint8_t i=0; i<16; i++) {
+    for (uint8_t i=0; i<ARRAY_SIZE(safe_pwm); i++) {
         if (chmask & (1U<<i)) {
             safe_pwm[i] = period_us;
         }
diff --git a/libraries/AP_HAL_ESP32/RCOutput.h b/libraries/AP_HAL_ESP32/RCOutput.h
index e7c00d7994..f8ac531dc6 100644
--- a/libraries/AP_HAL_ESP32/RCOutput.h
+++ b/libraries/AP_HAL_ESP32/RCOutput.h
@@ -118,10 +118,9 @@ private:
     static pwm_out pwm_group_list[];
 
     bool _corked;
-    uint16_t _pending[12]; //Max channel with 2 unit MCPWM
     uint32_t _pending_mask;
-
-    uint16_t safe_pwm[16]; // pwm to use when safety is on
+    uint16_t _pending[12];
+    uint16_t safe_pwm[12]; // pwm to use when safety is on
 
     uint16_t _max_channels;