Better to use silicon diodes for D1 and D2 rather than schottkies, on leakage grounds. I know their Vf is larger, on paper probably exceeding the maximum mux input voltage, but their leakage will be orders of magnitude lower. Some silicon diodes are advertised as low leakage. However, there's little point in striving for a leakage lower than your mux will provide. Note that both diode and mux leakage currents tend to increase exponentially with temperature, sometimes a horrible looking data sheet figure for worst case at temperature will be OK if you will only be using your system at ambient.
Use a resistor between the diode clamp and the mux input to limit the current into the muxes protection diodes, once D1 or D2 are clamping.
Not all multiplexers are equal, some have robust input protection as they're designed for this type of use. Some specify their input protection didoes can tolerate a high current. Do a wide search and read the data sheets carefully.
Do not assume leakage currents will cancel. Leakage is an uncontrolled parameter.
Don't forget to use an adequate voltage rating for R3, your common or garden resistor is usually only good for 200v. Use several in series, or one rated for a much higher voltage, they're not too expensive. Spikes of 1500v are common on mains.
Something like PUSB2X4Y has pulse specifications in the amps. If it can take a microseconds pulse of 4.5A at typically 3.8v across it, then you can assume it will take 10s of mA all day, every day, without embarrassment.
In case you haven't spotted Matthew's comment below, here is what I think he was suggesting, in the left-hand diagram, back to back diodes across a buffer op-amp.
simulate this circuit – Schematic created using CircuitLab
Although the op-amp output could be thought of as more current-capable than the inputs, it still has substrate diodes and a maximum current specification, so is also in need of protection itself. Some amplifiers even have inputs specified to well outside the rail for input protection, but only 0.3v overvoltage and weedy current spec on the output pin.
Going on from that basic idea, my take on the principle is shown on the right. The diode string D3-6 provides voltage clamping to 'a little outside' the rails, R2 protects the diodes, R4 protects the amplifier input, R3 protects the amplifier output and bootstraps the voltage across diodes D4 and D5 so that their leakage to the input is minimal. With such bootstrapping, the diodes could be almost anything, even big rufty-tufty bomb-proof rectifiers.
The two diodes in series suggests that care is needed in layout if protection is to extend to fast pulses. Consider the SOT-23 BAV99, two series diodes in one package, to implement the pair D3,4 and the pair D5,6. They are specified continuous >100mA, typical 10mS pulse 800mA, which for any reasonable R2 sounds adequate. BAT754S is an alternative in schottky. Similar currents, but much lower clamping voltage.
You do not actually need an op-amp per channel if your multiplexer leakage is low enough. The circuit at the bottom shows the single buffer following the mux driving all of the input protection diodes. Note that the multiplexer leakage appears at the amplifier input, whereas using a per-channel buffer eliminates mux leakage.
The 'on' channel is receiving the correct bootstrap voltage. The 'off' channels will probably be getting the wrong voltage, and the 'inner' protection diodes may well conduct. This is not a measurement problem, as the channel we want is correct. It may, or may not, be a problem to what is driving those inputs, to have our nominally high impedance inputs yanked off to a different voltage. If we assume it's a very feeble current source (we are concerned about leakage, so we know it's not a low impedance source) with a large capacitance to ground, it may take a long time after selecting that input before the voltage has returned to its correct value.
Actual leakage measurements for diodes at 15C.
diode -2/-5v leakage slope resistance over +/- 10mV
----- -------------- ------------------------------
1N4148 4nA 30Mohm
BAT42 35nA 1Mohm
BAS116 <10pA (30v) >>20Gohm
The BAS116 conduction continued as 40pA 300mV, 45nA 450mV, 16uA 640mV. The BAS116 typ/max spec at 25C is 3pA/5nA, and 3n/80n at 150C.
That means, at that temperature, and making the assumptions of reverse leakage varying by a factor of 2 up and down, and 3mV voltage follower offset, you could assume the following leakage
diode no bootstrap bootstrapped
----- ------------ ------------
1N4148 6nA 1pA
BAT54 50nA 3nA
BAS116 <10pA <<10pA
I made those measurements with a £8 meter with 10M input resistance and a 200mV range, so 10pA per LSB, not difficult (obviously can't tell the difference between 0 and 10pA!). I suggest you do the same with your chosen diodes and at higher temperatures.
Best Answer
It depends on how fast you want it...
Zener diodes have pretty high capacitance, so you'll need a low value series resistor, which means it will draw a lot of current from the signal source. With your 100R value, a 15V source would have to provide (15-3.3)/100 = 117mA current, and the resistor would burn 1.3W. Both are inconvenient.
If the signal is slow you can use a higher resistor, for example 3k3, which will make dissipation negligible but combined with Zener diode capacitance it will lowpass your signal at a few hundred kHz and introduce some phase shift too.
So you can use a pair of low capacitance diodes, there are many choices of dual diodes in SOT-23 available. You can use Schottky diode for a lower threshold voltage:
The first resistor limits current from the source, diodes limit voltage between -0.6V and 0.6V above VCC (or 0.3-0.4V if you use Schottky diodes). Since it will still go below GND and above VCC, the second resistor limits current into the FPGA protection diodes in case they conduct before the dual diode.
However it requires VCC to be able to sink some current, which won't happen if the loads are pretty low, for example a microcontroller in sleep mode. If the load on 3V3 is an FPGA, it'll draw enough power to sink the input current, so that's fine.
I've used this too:
The transistor and diodes make a shunt regulator at about 2.1V, the top diode and transistor add 0.6V twice, that will clip input voltage at 3V3. It follows the power supply, so it will behave correctly if the device is unpowered too.
You could also use a unidirectional TVS diode instead. It works like a Zener diode, with much lower capacitance at the cost of much lower accuracy. "Unidirectional" means it works like a normal diode in reverse, which is what you want since you're not interested in negative voltages.
So say you get a TVS diode specified for minimum 3V3, it will sink almost zero current at 3V3, but it will clamp the voltage so somewhere around 4.5-5V. So you still need a protection resistor to the FPGA pin, but it will conduct much less current than if the input was 15V and not limited to 5V.