diff --git a/doc/MODELS.md b/doc/MODELS.md
index 1eeda8b..61c3580 100644
--- a/doc/MODELS.md
+++ b/doc/MODELS.md
@@ -20,7 +20,7 @@ So far, stcgal was tested with the following MCU models:
 * STC15F104E (BSL version: 6.7Q)
 * STC15F204EA (BSL version: 6.7R)
 * STC15L104W (BSL version: 7.1.4Q)
-* STC15F104W (BSL version: 7.1.4Q)
+* STC15F104W (BSL version: 7.1.4Q and 7.2.5Q)
 * IAP15F2K61S2 (BSL version: 7.1.4S)
 * STC15L2K16S2 (BSL version: 7.2.4S)
 * IAP15L2K61S2 (BSL version: 7.2.5S)
diff --git a/stcgal/protocols.py b/stcgal/protocols.py
index 6ce408a..382792a 100644
--- a/stcgal/protocols.py
+++ b/stcgal/protocols.py
@@ -1394,16 +1394,19 @@ class Stc15Protocol(Stc15AProtocol):
         # hardware UART. Only one family of models seems to lack a hardware
         # UART, and we can isolate those with a check on the magic.
         # This is a bit of a hack, but it works.
-        bauds = self.baud_transfer if (self.mcu_magic >> 8) == 0xf2 else self.baud_transfer * 4
-        packet += struct.pack(">H", int(65535 - program_speed / bauds))
-        packet += bytes(user_trim)
+        if (self.mcu_magic >> 8) == 0xf2:
+            packet += struct.pack(">H", int(65536 - program_speed / self.baud_transfer))
+            packet += struct.pack(">H", int(65536 - program_speed / 2 * 3 / self.baud_transfer))
+        else:
+            packet += struct.pack(">H", int(65536 - program_speed / (self.baud_transfer * 4)))
+            packet += bytes(reversed(user_trim))
         iap_wait = self.get_iap_delay(program_speed)
         packet += bytes([iap_wait])
         self.write_packet(packet)
         response = self.read_packet()
         if len(response) < 1 or response[0] != 0x01:
             raise StcProtocolException("incorrect magic in handshake packet")
-        time.sleep(0.2)
+        time.sleep(0.1)
         self.ser.baudrate = self.baud_transfer
 
     def switch_baud_ext(self):
@@ -1413,14 +1416,17 @@ class Stc15Protocol(Stc15AProtocol):
         sys.stdout.flush()
         packet = bytes([0x01])
         packet += bytes([self.freq_count_24, 0x40])
-        packet += struct.pack(">H", int(65535 - self.mcu_clock_hz / self.baud_transfer / 4))
+        bauds = int(65536 - self.mcu_clock_hz / self.baud_transfer / 4)
+        if bauds >= 65536:
+            raise StcProtocolException("baudrate adjustment failed")
+        packet += struct.pack(">H", bauds)
         iap_wait = self.get_iap_delay(self.mcu_clock_hz)
         packet += bytes([0x00, 0x00, iap_wait])
         self.write_packet(packet)
         response = self.read_packet()
         if len(response) < 1 or response[0] != 0x01:
             raise StcProtocolException("incorrect magic in handshake packet")
-        time.sleep(0.2)
+        time.sleep(0.1)
         self.ser.baudrate = self.baud_transfer
 
         # for switching back to RC, program factory values
@@ -1664,7 +1670,7 @@ class Stc8Protocol(Stc15Protocol):
         sys.stdout.flush()
         packet = bytes([0x01, 0x00, 0x00])
         bauds = self.baud_transfer * 4
-        packet += struct.pack(">H", round(65535 - 24E6 / bauds))
+        packet += struct.pack(">H", round(65536 - 24E6 / bauds))
         packet += bytes([user_trim[1], user_trim[0]])
         iap_wait = self.get_iap_delay(24E6)
         packet += bytes([iap_wait])