A novel system-theoretic approach for human-system collaboration safety: Case studies on two degrees of autonomy for autonomous ships