The 'hierarchy of controls' applied specifically to product safety design places which option as the most preferred method of hazard elimination?