add init checks
diff --git a/include/grpc/census.h b/include/grpc/census.h
index a02724e..9b89f9f 100644
--- a/include/grpc/census.h
+++ b/include/grpc/census.h
@@ -51,7 +51,9 @@
 
 /* Shutdown and startup census subsystem. The 'functions' argument should be
  * the OR (|) of census_functions values. If census fails to initialize, then
- * census_initialize() will return a non-zero value. */
+ * census_initialize() will return a non-zero value. It is an error to call
+ * census_initialize() more than once (without an intervening
+ * census_shutdown()). */
 int census_initialize(int functions);
 void census_shutdown();
 
diff --git a/src/core/census/initialize.c b/src/core/census/initialize.c
index d72c08b..057ac78 100644
--- a/src/core/census/initialize.c
+++ b/src/core/census/initialize.c
@@ -33,6 +33,18 @@
 
 #include <grpc/census.h>
 
-int census_initialize(int functions) { return 0; }
+static int census_fns_enabled = CENSUS_NONE;
 
-void census_shutdown() {}
+int census_initialize(int functions) {
+  if (census_fns_enabled != CENSUS_NONE) {
+    return 1;
+  }
+  if (functions != CENSUS_NONE) {
+    return 1;
+  } else {
+    census_fns_enabled = functions;
+    return 0;
+  }
+}
+
+void census_shutdown() { census_fns_enabled = CENSUS_NONE; }
diff --git a/src/core/surface/init.c b/src/core/surface/init.c
index 5cd5d91..ac6871c 100644
--- a/src/core/surface/init.c
+++ b/src/core/surface/init.c
@@ -64,7 +64,9 @@
     grpc_security_pre_init();
     grpc_iomgr_init();
     grpc_tracer_init("GRPC_TRACE");
-    census_initialize(CENSUS_NONE);
+    if (census_initialize(CENSUS_NONE)) {
+      gpr_log(GPR_ERROR, "Could not initialize census.");
+    }
     grpc_timers_global_init();
   }
   gpr_mu_unlock(&g_init_mu);