A hoist system for critical loads incorporates improved safety technology to monitor various possible fault conditions. For example, a command-not-operated function causes braking of the hoist when an encoder detects one of a group of conditions including a lack of load movement when a movement command is issued by the operating system, failure of encoder feedback, or failure of a control circuit. An uncommanded motion function also causes braking of the hoist when an encoder detects one of a group of conditions including load movement without a movement command issued by the operating system, or reverse directional movement of the load from a directional movement command input by the operating system.