Lpc2000

I'm trying to setup a failproof flash update method, so an interrupted
and incomplete flash update would not force to open the unit and
insert a jumper etc.

We did thuch things with other controllers, by using one sector as a
fixed service monitor, which was always called by reyset, and then
passed operation to the application, after the application had been
proved valid by checking some CRC or so.

This service monitor was never deleted, and allowed for recover, if
something went wrong during flash update procedure.

Now the LPC family incorporates something similar with the Flash Boot
Loader, but unfortunately this original Boot Loader is restricted to
the serial port, which is not available on top of every box we do.

So we came to the point, that replacing this Flash Boot Loader might
be the way out. 
Did anybody else try this? 
Is it possible, are there any restrictions?

Thanks,
Andreas