Safe operation of dual-fuel engines using constrained stochastic control