Instead of keeping hazards under control by adding on protective equipment we should use inherently safer designs whenever they are 'reasonably practicable'. When that is not possible passive safety equipment is better than active equipment; simple examples are described. Inherently safer designs have not been adopted as rapidly as other process safety features and are often ignored in the recommendations made after accidents; the reasons are discussed. Inherently safer designs are usually cheaper than conventional ones and are a lesser target for terrorists.