I have an analog output that I need to protect from continuous overvoltage in case of incorrect connection by amateur installers. For those who are interested, I am currently working on a part of the BMS for a professional lithium-ion system.
The output range is 0V to 15V with an expected load resistance ≥10kΩ that is tied to ground in most cases. The output is not necessarily required to achieve true 0V but it should come as close as possible. It is mostly a question of balancing the effort of an additional negative supply and the expected benefit. The input signal is pure DC. The output's dynamic behavior is not important, except for it being stable.
The analog output consists of a digital to analog converter followed by an amplifier for range adjustment and buffering. The operational amplifier is supplied by the battery voltage (6V to 15.4V minus two schottky diode drops) with the option of doubling the supply voltage through a charge pump if required to achieve the desired output voltage. The circuit is obviously battery powered so the quiescent current should be low. I therefore opted to use an operational amplifier with shutdown and a charge pump instead of a boost converter for supply voltage increase. The protection circuits additional quiescent current should be no more than an additional 100µA when the amplifier is enabled and no more than 10µA when the amplifier is disabled.
The expected overvoltage is continuous and in the range of -16V to 32V (when the output is accidentally connected to a battery pole in a connection of up to two batteries in series).
Although I researched the internet extensively, I did not find a solution for my requirements. In fact, I did not even find something mildly related. So I had to come up with a solution of my own and I would like some feedback from developers with similar problems.
Here is the circuit that I came up with. It works in simulation but I did not test it in practise yet.

simulate this circuit – Schematic created using CircuitLab
The components have the following functions:
- R1 & C1 are the input filter for DAC filtering and loop shaping
 - OA1 is the operational amplifier with internal short circuit and over-temperature protection. The output has ESD protection diodes towards negative and positive supply
 - R2, R3 & C3 are the feedback network for steady state gain setting and loop shaping
 - D1 & D2 block reverse current into the supply and are part of said charge pump for supply voltage doubling
 - C2 is the local supply capacitor and the charge pump's output capacitor
 - M1 blocks current due to negative output overvoltage. R5 biases M1 so that it is active under normal operating conditions. If the output falls more than a diode drop below ground, Q1 disables M1 and therefore blocks excessive current through OA1's clamping diode. R4 can limit the current if Q1 reacts too slow in practice. R6, R7 & C4 are the biasing network for Q1. Since the failure condition may stay indefinitely, the DC resistance must be large to avoid excessive leakage current (large R7). The dynamic base resistance must be small though, to allow fast reaction (small R6 and C4).
 - M2 limits the positive overvoltage to the supply voltage minus M2's threshold voltage. The gate network performs the same function as Q1's. The OPA will sink the short circuit current in this case and go into thermal limitation. It will not die but likely age significantly. Maybe I will use an additional BJT to get rid of this problem.
 
Please criticize my circuit. I am open for all types of improvements or alternative solutions. I was looking for an integrated solution, either integrated in an OPA or as a separate IC, but could not find any.




