Background
The task is to add an electronic means to limit the power applied to an electric motor in an industrial setting. The operator normally controls the motor power through a lever that is mated to a 5KΩ pot:
simulate this circuit – Schematic created using CircuitLab
The electronic device I want to add should be able to cap the signal to a limit, so that the signal fed to the ESC follows the relation
$$V_{\text{out}} = \text{min}(V_{\text{in}}, V_{\text{limit}})$$
or (thanks to @GlennW9IQ for suggesting it!)
$$V_{\text{out}} = V_{\text{in}} * V_{\text{limit}}$$
(in the second case, assume Vlimit is 0..1, i.e. just a normalized multiplier).
One very important detail is that whatever I add should not be able to generate a phantom signal, i.e. Vout MUST be always less or equal to Vin, even in the event of software bugs and reasonable hardware failures. To this end, I initially drafted something like this:
Draft 1
There are also other details, e.g. a relay to bypass the whole circuit if my device is unpowered. The purpose of OA1 is to buffer the input signal so it can be read through a MCU ADC pin. With this schematic, I can be reasonably sure I cannot inject a positive voltage on ESC's input, since I can only pull the pot's signal down. The problem is that OA2 cannot bring the signal to 0V if the limit signal says so, because the output will always be at least the Vf of the diode. In theory that can be fixed if I add a negative rail to V- of OA2. But in practice this is unfeasible.
Draft 2
So I have this new draft, shown here just the part to the right of OA2:
Problem
The schematic in Draft 2 is capable of pulling the pot readout hard to 0V, but I fear the feedback loop is too complicated, too high gain, and the output is going to oscillate a lot.
I've intentionally left the ?? box, because I think that's where some oscillation/stabilization components should be added (e.g. 220k||1µF to ground). The good news is that the input is fairly low-bandwidth, say 10 Hz (how fast can you turn a pot?) and it's okay if the output has some defects/overshoots, since the motor has a lot of inertia. I just don't want it to oscillate all the time.
Problem
So: how to stabilize this feedback loop and prevent any oscillations?
EDIT
Based on suggestions in comments, I've updated Draft 2 to include an integrator around OA2:
If I'm understanding the theory correctly, OA2's feedback loop is now bandwidth-limited to around 50 Hz, with -3dB corner frequency around 5Hz. Will these additions suffice?
EDIT #2
As suggested by @GlennW9IQ, I presented the option that the limit value modulates the input, i.e. you can still use the full range of the pot, however your output range is rescaled according to the limit. See the updated formulas for Vout.
EDIT #3
Additional circuit/system details:
- My device has a 3.3V power rail, hence the need for resistive dividers, opamp buffers, etc.
- I don't have a 5V rail handy (I don't want to use the one from the ESC-to-pot cable).
- The Vlimit signal is generated by a 8-bit DAC and its Vref can be either 3.3V or 2.048V.