Index: firmware/App/Controllers/BloodFlow.c
===================================================================
diff -u -r93a439cf9d1b347e23b84d1156417380ee01efaa -rc9cf3c88d4db4ddeb62c85489bbcb25e48688c35
--- firmware/App/Controllers/BloodFlow.c	(.../BloodFlow.c)	(revision 93a439cf9d1b347e23b84d1156417380ee01efaa)
+++ firmware/App/Controllers/BloodFlow.c	(.../BloodFlow.c)	(revision c9cf3c88d4db4ddeb62c85489bbcb25e48688c35)
@@ -52,6 +52,7 @@
 #define BP_HOME_TIMEOUT_MS                  10000           ///< maximum time allowed for homing to complete (in ms).
 #define BP_SPEED_CALC_INTERVAL              ( MS_PER_SECOND / TASK_PRIORITY_INTERVAL )  ///< interval (ms/task time) at which the blood pump speed is calculated.
 #define BP_HALL_EDGE_COUNTS_PER_REV         48              ///< number of hall sensor edge counts per motor revolution.
+#define BP_MAX_ROTOR_SPEED_RPM              100.0           ///< maximum rotor speed allowed for blood pump.
 
 #define BP_MAX_FLOW_VS_SPEED_DIFF_ML_MIN    50.0            ///< maximum difference between measured flow and flow implied by measured motor speed.
 #define BP_MAX_MOTOR_SPEED_WHILE_OFF_RPM    100.0           ///< maximum motor speed (RPM) while motor is commanded off.
@@ -970,6 +971,8 @@
  *************************************************************************/
 static void checkBloodPumpRotor( void )
 {
+    F32 rotorSpeed = getMeasuredBloodPumpRotorSpeed();
+
     // if homing, check timeout
     if ( ( TRUE == bpStopAtHomePosition ) && ( TRUE == didTimeout( bpHomeStartTime, BP_HOME_TIMEOUT_MS ) ) )
     {
@@ -978,6 +981,12 @@
         // TODO - alarm???
     }
 
+    // ensure rotor speed below maximum
+    if ( rotorSpeed > BP_MAX_ROTOR_SPEED_RPM )
+    {
+        SET_ALARM_WITH_1_F32_DATA( ALARM_ID_BLOOD_PUMP_ROTOR_SPEED_TOO_HIGH, rotorSpeed )
+    }
+
     // if pump is stopped or running very slowly, set rotor speed to zero
     if ( TRUE == didTimeout( bpRotorRevStartTime, BP_HOME_TIMEOUT_MS ) )
     {