Erase protection can be used to prevent a device from being erased.
A device ERASEALL operation can be initiated either by the non-volatile memory controller, or through the control access port. The following table describes the protection of the CTRL-AP ERASEALL operation. For more information, see Access port protection
| Access port protection state | ERASEALL operation | |
|---|---|---|
| UICR.ERASEPROTECT | TAMPC.PROTECT.ERASEPROTECT | ERASEALL |
| Unprotected | Unprotected | Allowed |
| Protected | - | Disabled |
| - | Protected | Disabled |
The debugger can read the erase protection status in the register ERASEPROTECT.STATUS.
When erase protection is enabled, both the debugger and on-board firmware are required to disable it. The same non-zero 32-bit KEY value must be written to the debugger register ERASEPROTECT.DISABLE and CPU register ERASEPROTECT.DISABLE to disable erase protection. When both registers have been written with the same non-zero 32-bit KEY value, the device is automatically erased as described in Erase all. The access ports will be re-enabled on the next reset once the secure erase sequence has completed.
Set the write-once register ERASEPROTECT.LOCK to Locked as early as possible in the start-up sequence, preferably as soon as the on-chip firmware has determined it does not need to communicate with a debugger over the CTRL-AP mailbox interface. Once written, it will not be possible to remove the erase protection until the next pin reset, power-on reset, brownout reset, or watchdog timer reset, and therefore ERASEPROTECT.DISABLE is also disabled.