Safe diagnosability for fault-tolerant supervision of discrete-event systems