Note that low voltage zeners aren't much better than 5-6V zeners, due to the softness of the knee. The clamping voltage will still be in the 7-10V range, give or take. The main difference then, is the extra leakage that low-voltage types have.
The preferred LV clamping solution is a crowbar. SCRs capable of sinking the brunt of that, are readily available. Maybe not DPAK size, but D2PAK/TO-220 certainly.
The 12V supply then needs a fuse, which can be a PolyFuse type. Check fusing I^2t against SCR, and consider input supply rating. If the supply is capable of several times the fuse rating, it's probably worthwhile using a fuse. If not, then the crowbar likely browns out the supply, rather than clearing the fuse; it'll sit there in current limit or hiccup, while the SCR remains latched on, never blowing the fuse, and potentially putting the supply in danger. (Hiccup is usually a low-power condition, so, safe to sit in for extended periods of time. Current limit, depends; it may get hot, it may not last forever; sometimes current limits are more of an afterthought unfortunately.) In that case, you may prefer a supply with latched overload (stays off), and the fuse won't really matter.
Or the hiccup mode stays off for long enough that the SCR clears, and the cycle repeats from a higher turn-on voltage. Which I guess puts some wear on the SCR, but it should actually be fine with that, it's not much of a wear item within ratings. Thermal cycling maybe?
Other options include:
- A second pass device, as an electronic fuse. Could be a TI e-Fuse, could be anything else, could be a custom solution, whatever you like.
- Modify operation of the controller. Example: add series gate resistor to PMOS, and hard clamp G-S when fault conditions are detected (Vout > threshold, high side pulse width too long, etc.). Tweaks like this depend on likelihood of failure modes; you're not fixing the underlying problem (the PMOS could still fail), but addressing one of the effects that could lead to that end (controller failure cascading into load or PMOS failure).
- Note that the crowbar fits into this list as a "modify operation of the load" option. You can open-circuit or short-circuit the input or output, to remove the hazard condition. Whatever works, really.
- Just Don't Break It(TM). More specifically: address environmental stresses that are likely to cause failure. Clamp overvoltage transients, use conformal coating over the IC, mount the board firmly to avoid fracture of capacitors, solder joints, etc.; maybe mechanically isolate it, or fully encapsulate (pot) it. It still has the internal single-failure-point condition, but you can do everything possible to prevent those failures from occurring. Thermal cycling and aging/wear (semiconductors are nearly unlimited-life devices, except for a handful of effects which may still be relevant: electromigration, and hot-carrier injection in CMOS circuits, for example) can still occur, but they can be managed with suitable design.
And don't forget that it's always a value proposition. If all it's protecting is a handful of TTL chips, or jellybean MCU or whatever, pfft, who cares, let 'em cook. (TTL might even survive the 12V, crazy at that is...) Maybe if it's a vintage unit with hard-to-find parts, and it's more than just obscure TTL, but rare ASICs or whatever too, you'd like to add such precautions. Or it's a whack of high-performance FPGAs, and board failure means scrapping five digits USD of components.
By and large, PoL (point of load) converters are not exposed to stresses, at least beyond the occasional overcurrent (heavy/shorted load, should the supply be available on connectors, say), and have very little reason to fail suddenly. And, by and large, commercial equipment isn't concerned with FMEA, so a single point of failure is acceptable. And indeed, the billions of machine-hours these devices rack up, speaks testament to this judgement call. So, you really need additional justification for taking such measures -- whether it's just very rare or expensive, or it's medical or military (critical life systems), or aerospace (where maintenance is patently impossible).
Tim