A Model of Integrated Operator-System Separation Assurance and Collision Avoidance