Design a schematic for a three-processor AI-integrated flight controller for agricultural, industrial inspection, and general autonomous drone applications. This is NOT a weapons, targeting, or loitering munition system — keep the design strictly within civilian agri/industrial UAV scope.

ARCHITECTURE (strict separation of function, do not merge or simplify):

1. AI/Vision MPU: NXP i.MX 8M Plus (MIMX8ML8DVNLZAA)
   - Runs NPU inference only (obstacle detection, landing-zone detection, crop monitoring)
   - Never controls motors directly
   - Connects to the flight MCU over exactly one SPI link (SPI4) — no other direct link to the flight MCU
   - Interfaces: MIPI CSI-2 (2-lane) direct to camera sensor (Sony IMX219/IMX477, Raspberry Pi Camera Module 2/3-compatible pinout), microSD, LPDDR4 (2GB), eMMC (16GB)
   - Powered by NXP PF8100 PMIC with correct multi-rail power-up sequencing per NXP application note

2. Flight control MCU: STM32H753VIT6 (LQFP100)
   - Owns all sensor fusion (EKF), PID stabilization, navigation, and every external comms/output interface
   - This is the primary flight computer
   - Powered by an independent TI TPS62130-class buck converter (3.3V rail), physically separate from the safety MCU's supply

3. Safety/fallback MCU: STM32G491 (assume LQFP64, STM32G491RET6 pending final confirmation)
   - Sole job: monitor a dedicated heartbeat GPIO from the H753 and trigger failsafe (switch/buzzer/optional hard motor cutoff) if the heartbeat stops
   - Must be electrically and functionally independent of both other processors
   - Powered by its own separate TPS62130-class buck converter, never sharing a bus with H753 or i.MX 8M Plus for its monitoring function

SAFETY-CRITICAL RULES (do not relax without explicit flag):
- Heartbeat signal H753 → G491 must be a single dedicated GPIO line, never a bus/message-based signal
- IMU #1 and IMU #2 must be on physically separate SPI buses and different silicon vendors
- MAIN OUT (motors) and AUX OUT (servos/payload) must never share a timer peripheral: MAIN on TIM1/TIM8, AUX on TIM3/TIM4
- G491 must not depend on the AI MPU and must not share failure modes with H753
- The AI MPU only sends advisory data to H753 over SPI4 — it never issues direct motor commands; H753 validates and acts on all AI input

ONBOARD SENSORS (soldered to PCB):
- IMU #1: Bosch BMI088 on SPI1
- IMU #2: InvenSense ICM-42688-P on SPI2 (separate vendor/die from IMU #1)
- Barometer: Bosch BMP388 on SPI3
- Magnetometer: Bosch BMM150 on I2C1 (backup only, primary compass is external GNSS puck)
- Temperature sensor near IMUs on I2C1 for gyro/accel thermal compensation

EXTERNAL CONNECTORS (v1 finalized list — do not add beyond this without flagging):
- CAN-FD x2 (CAN1: ESC/GNSS/DroneCAN, CAN2: payload/expansion), each with its own TI TCAN1042HGVDRQ1 transceiver and PESD1CAN ESD protection — never share a transceiver between buses
- I2C x2 (compass splitter, general peripheral)
- USB Type-C x1, CC-only via TI TUSB320LAIRWBR, no PD negotiation, USBLC6-2SC6 ESD protection
- TELEM 1 and TELEM 2: UART + MAVLink RF telemetry (no WiFi — explicitly rejected in favor of RF telemetry)
- BUZZER x1 (G491 domain)
- SPKT/DSM x1 (secondary RC path)
- SWITCH x1 (safety switch, G491 domain)
- SERIAL 4/5 x1 (general expansion UART)
- GPS 1 (mandatory) + GPS 2 (optional/redundant)
- ADC 3.3V x1, ADC 6.6V x1
- SPI x1 (external expansion)
- POWER x1 (battery V/I sense connector)
- MAIN OUT 1-6 (motors, TIM1/TIM8) and AUX OUT 1-6 (servos/payload, TIM3/TIM4)
- Expansion header: spare UART + spare I2C + CAN2 tap, for future thermal/LiDAR/payload modules without a board respin
- General GPIO/UART lines protected with PESD5V0S1BA ESD protection

EXPLICITLY EXCLUDED FROM V1 (do not add):
3rd IMU, 2nd barometer, onboard thermal camera, onboard LiDAR/ultrasonic, 2nd CSI-2 lane/multispectral camera, Gigabit Ethernet, 2nd USB-C port, CAN3/CAN4, UART5/UART6 beyond listed, SPI5/SPI6, I2C4, external debug connector (internal header only), WiFi.

SHEET STRUCTURE (organize hierarchically, one sheet per block):
1. Top-level block diagram
2. Power tree (battery input protection, dual independent 3.3V bucks for H753/G491, PF8100 multi-rail sequencing for i.MX 8M Plus, battery V/I sense)
3. i.MX 8M Plus core (MPU, LPDDR4, eMMC, MIPI CSI-2, SPI4 only, microSD)
4. STM32H753 core (MCU, decoupling, reset, boot config, crystal, all peripheral stubs)
5. STM32G491 core (MCU, decoupling, reset, boot config, crystal, heartbeat GPIO input, buzzer/switch outputs)
6. Inter-processor links (SPI4 only, heartbeat GPIO only — nothing else crosses between processor sheets)
7. CAN-FD (both buses, separate transceivers)
8. Serial/telemetry/RC (TELEM1, TELEM2, SERIAL4/5, SPKT/DSM)
9. USB-C
10. GPS/compass/I2C
11. ADC (3.3V and 6.6V)
12. Motor/servo outputs (MAIN on TIM1/TIM8, AUX on TIM3/TIM4, kept on separate timers)
13. Expansion header
14. Onboard sensors (BMI088, ICM-42688-P, BMP388, BMM150, temp sensor)

NOTE: STM32H753 has known pin contentions (PA9/PA10/PA11 shared between UART1 and MAIN OUT timer channels; PB5/PB6 shared between CAN2 and AUX OUT/I2C1) that must be resolved via STM32CubeMX before finalizing exact pin numbers — flag this rather than silently picking one.

Generate the schematic sheet by sheet in the order listed above, using standard net naming and net classes (e.g. MOTOR_PWM, SERVO_PWM, CAN1, CAN2, HEARTBEAT, AI_LINK_SPI4). Flag any pin number, ball map, or package detail that should be cross-checked against the official datasheet or CubeMX/NXP Pins Tool rather than presented as final.