The problem of safe failure diagnosis in discrete event systems is addressed. Starting from the standard definition of diagnosability of discrete event systems, which deals with the problem of detecting the occurrence of an unobservable event using the available observations on the system, the problem of performing the detection before the system executes a forbidden string is introduced. For example, this constraint could be required to prevent local faults from developing into failures that could cause safety hazards. This idea results in a new language property for discrete event systems called safe diagnosability. Necessary and sufficient conditions to test this language property are presented. Moreover, the problem of explicitly taking into account safe diagnosability as a requirement in system design is discussed.