New schematic.
Added the thermal cutoff. The thermistor is a Vishay NTCLE100E3104JB0 - 13.4k at 75°C. That puts 0.64V on Q17, switching on the two-transistor "thyristor". You must power-cycle to reset (I think that's a good thing. Not only does it keep the transistor from getting hot, but it keeps you from leaving a heavy load attached, walking away, and letting it slowly cook itself as it shuts off and comes back on repeatedly.)
The current flow is a bit unconventional - I noticed that if something were to go wrong in the current control feedback path, the voltage error amp could saturate high and actually risk damaging a few parts. I added resistors and clamp diodes (R9 and D4, which have already been there, and R33 and D10) to prevent this problem, and then took advantage of them in the thermal cutoff to save parts, by
intentionally saturating the amplifier. When the Q17/Q18 thyristor switches on, the feedback path is slammed to VEE, sending the output high (this is the
negative output, so "high" means "no output" here). Q5A saturates, drawing base current through Q7, through D4 and over to the thyristor - but not before it goes through a warning annunciator LED, DS1. Because this also saturates Q7, the output transistor's B-E junction would be reverse biased. I added R33 to limit current and D10 to clamp the voltage.
I also changed the output transistor to a TIP105 Darlington, which has a protection diode built-in, eliminates Q8 from the PCB (moving some of the power dissipation off the PCB and onto the heatsink), and is a bit cheaper too.
I was worried that if the output is connected to a voltage source while power is off (referring to your latest schematic) C2 will stay uncharged because of the diode string D1,D5,D6, and the voltage reference which is powered from the output will together with the voltage sense resistors provide current which can flow through the BC-diodes of the voltage error amplifier input devices, breaking down the BE-diode of Q7 (and maybe Q16A-B too) in reverse. The current is limited though so this would amount to degradation of the transistors at most.
Solved, I believe, by adding a bypass diode (D11) antiparallel to the diode string.
If the output is connected to a voltage source with a higher voltage than the setpoint with AC power on, if I'm not mistaken Q7 will try to saturate and pull quite high current (looks like you have enough base drive to get a few hundreds of milliamps) in reverse through the BE diodes of Q8 and Q9. Something would probably let out the magic smoke almost instantaneously.
Yup, found this problem already (as mentioned above). Q7 no longer commits murder-suicide when it saturates.
Speaking of high voltages, an interesting problem that does exist in SPICE but
not in real life is that a forced voltage higher than the voltage across C2 will blow up D11 in SPICE, but not in real life, because in real life that voltage comes through a rectifier.
It also looks like the current source for the current error amplifier, Q11, will start to saturate if the output voltage starts to reverse. Collector-base voltage is about 0 V when the output voltage is 0 V, right? But maybe this is not a problem? As long as you keep the externally forced current below the rating of the supply the current throuh the output transistor can't exceed the design value anyway.
Correct.
Were you simulating this in LTspice? Something to look out for is that the standard transistor models don't model reverse breakdown of the BE-diode.
Yes, I finally gave in to the temptation of SPICE, and it bit me. I've been checking manually for B-E reverse bias but missed that one.
Time to go back to pen and paper.