A control circuit includes a pump shutdown module responsive to one or more inputs indicating at least from the group consisting of an operational error at the implantable blood pump and an adverse physiological state of a user of the implantable blood pump. The pump shutdown module ceases operation of the implantable blood pump in response to the one or more inputs. A pump restart module configured to resume operation of the implantable blood pump in response to a first pump restart input and a second pump restart input is included. A pump restart lockout module configured to initiate a pump lockout mode in response to a lockout input is included. The pump lockout mode prevents resumption of operation of the implantable blood pump in response to the first pump restart input and allows resumption of operation of the implantable blood pump in response to the second pump restart input.
