Better to use silicon diodes for D1 and D2 rather than schottkies, on leakage grounds. I know their Vf is larger, on paper probably exceeding the maximum mux input voltage, but their leakage will be orders of magnitude lower. Some silicon diodes are advertised as low leakage. However, there's little point in striving for a leakage lower than your mux will provide. Note that both diode and mux leakage currents tend to increase exponentially with temperature, sometimes a horrible looking data sheet figure for worst case at temperature will be OK if you will only be using your system at ambient.
Use a resistor between the diode clamp and the mux input to limit the current into the muxes protection diodes, once D1 or D2 are clamping.
Not all multiplexers are equal, some have robust input protection as they're designed for this type of use. Some specify their input protection didoes can tolerate a high current. Do a wide search and read the data sheets carefully.
Do not assume leakage currents will cancel. Leakage is an uncontrolled parameter.
Don't forget to use an adequate voltage rating for R3, your common or garden resistor is usually only good for 200v. Use several in series, or one rated for a much higher voltage, they're not too expensive. Spikes of 1500v are common on mains.
Something like PUSB2X4Y has pulse specifications in the amps. If it can take a microseconds pulse of 4.5A at typically 3.8v across it, then you can assume it will take 10s of mA all day, every day, without embarrassment.
In case you haven't spotted Matthew's comment below, here is what I think he was suggesting, in the left-hand diagram, back to back diodes across a buffer op-amp.
simulate this circuit – Schematic created using CircuitLab
Although the op-amp output could be thought of as more current-capable than the inputs, it still has substrate diodes and a maximum current specification, so is also in need of protection itself. Some amplifiers even have inputs specified to well outside the rail for input protection, but only 0.3v overvoltage and weedy current spec on the output pin.
Going on from that basic idea, my take on the principle is shown on the right. The diode string D3-6 provides voltage clamping to 'a little outside' the rails, R2 protects the diodes, R4 protects the amplifier input, R3 protects the amplifier output and bootstraps the voltage across diodes D4 and D5 so that their leakage to the input is minimal. With such bootstrapping, the diodes could be almost anything, even big rufty-tufty bomb-proof rectifiers.
The two diodes in series suggests that care is needed in layout if protection is to extend to fast pulses. Consider the SOT-23 BAV99, two series diodes in one package, to implement the pair D3,4 and the pair D5,6. They are specified continuous >100mA, typical 10mS pulse 800mA, which for any reasonable R2 sounds adequate. BAT754S is an alternative in schottky. Similar currents, but much lower clamping voltage.
You do not actually need an op-amp per channel if your multiplexer leakage is low enough. The circuit at the bottom shows the single buffer following the mux driving all of the input protection diodes. Note that the multiplexer leakage appears at the amplifier input, whereas using a per-channel buffer eliminates mux leakage.
The 'on' channel is receiving the correct bootstrap voltage. The 'off' channels will probably be getting the wrong voltage, and the 'inner' protection diodes may well conduct. This is not a measurement problem, as the channel we want is correct. It may, or may not, be a problem to what is driving those inputs, to have our nominally high impedance inputs yanked off to a different voltage. If we assume it's a very feeble current source (we are concerned about leakage, so we know it's not a low impedance source) with a large capacitance to ground, it may take a long time after selecting that input before the voltage has returned to its correct value.
Actual leakage measurements for diodes at 15C.
diode -2/-5v leakage slope resistance over +/- 10mV
----- -------------- ------------------------------
1N4148 4nA 30Mohm
BAT42 35nA 1Mohm
BAS116 <10pA (30v) >>20Gohm
The BAS116 conduction continued as 40pA 300mV, 45nA 450mV, 16uA 640mV. The BAS116 typ/max spec at 25C is 3pA/5nA, and 3n/80n at 150C.
That means, at that temperature, and making the assumptions of reverse leakage varying by a factor of 2 up and down, and 3mV voltage follower offset, you could assume the following leakage
diode no bootstrap bootstrapped
----- ------------ ------------
1N4148 6nA 1pA
BAT54 50nA 3nA
BAS116 <10pA <<10pA
I made those measurements with a £8 meter with 10M input resistance and a 200mV range, so 10pA per LSB, not difficult (obviously can't tell the difference between 0 and 10pA!). I suggest you do the same with your chosen diodes and at higher temperatures.
Best Answer
Yes, that would work fine, but you can make this even more simple:
simulate this circuit – Schematic created using CircuitLab
Zener diodes behave more or less as a "normal" diode when in forward mode so we can use that to clamp negative voltages.
When using a 12V, 400 mW zener diode the maximum current through the zener diode can be 400mW / 12 V = 33 mA. There will then be 12 V across R1, R1 needs to limit the current to 33 mA so it needs to be: 12 V / 33 mA = 364 ohm or higher. I added some margin and suggest 470 ohms then the actual current will be 12 V / 470 ohm = 26 mA and R1 will dissipate 12 * 26 mA = 0.312 W so you might want to use a 0.5 W resistor (or use two 1 kohm 0.25 W resistors in parallel).
I would make the capacitor C1 10 nF, that should suffice to remove most pulses. Only if you need to measure high frequency signals C1 might need to get a smaller value or must be removed. Then the zener diode might be an issue as well as zeners aren't very fast. But if you stay below 100 kHz or so there should be no issue with this circuit.