I have an MSP430F169 that I'm trying to program using the BSL protocol. I don't have a JTAG programmer. Unfortunately, the MSP430F169 responds with NAK (A0) even to the unprotected commands (except the sync):
(sync) DATA WRITE: 80 DATA READ: 90 (OK) (get version) DATA WRITE: 80 1E 04 04 00 00 00 00 7B E5 DATA READ: A0 (NAK)
(sync) DATA WRITE: 80 DATA READ: 90 (OK) (mass erase) DATA WRITE: 80 18 04 04 FE FF 06 A5 83 B9 DATA READ: A0 (NAK)
The MSP430F169 is supposed to come with BSL version 1.61 (according to SLAU319N, page 37), so the version command is supposed to work. In the web page https://e2e.ti.com/support/microcontrollers/msp430/f/166/t/468602 the author discusses a different issue but reports that his MSP430F169 responds to the version commands.
Regarding the mass erase, I saw in another page that despite the AL AH bytes being documented as don't care, they actually needed to be a valid flash address in some devices/BSL versions. So I've tried sending all of the 0x10000 AL AH combinations, but to no avail.
As far as I understand, the JTAG fuse doesn't affect the BSL, but I'm not sure about that. In any case, I don't expect that the two MSP430F169 boards I have to both have come with their JTAG fuses blown, as supposedly this isn't second hand equipment. Is there any other protection mechanism that could be affecting the BSL?
Any ideas on how to solve this issue?
Here's a 'scope capture of the sync and mass erase command (no delay between bytes, to fit in the 'scope window). Everything looks fine to me and to the UART decoder: