Enabling device protection

There are several ways to protect the nRF54L Series devices. Access Port Protection (APPROTECT) secures the access port, Erase Protection (ERASEPROTECT) stops the device from being erased, and Secure Access Port Protection (SECUREAPPROTECT) stops unauthorized access to secure resources.

Note: If the device has activated both APPROTECT and ERASEPROTECT, it cannot be recovered without a proper software solution. See Checking protection status for more information.

Devices that feature Arm® TrustZone® have individual control over secure and non-secure access port protection.

The following table lists the available protection mechanisms for nRF54L Series devices.

Table 1. Device protection mechanisms
Devices	Available protection mechanisms
nRF54L05, nRF54L10, nRF54L15, nRF54LM20A, nRF54LM20B, nRF54LV10A	SECUREAPPROTECT, APPROTECT, and ERASEPROTECT
nRF54LS05A, nRF54LS05B	APPROTECT and ERASEPROTECT

APPROTECT

APPROTECT locks the Tamper Controller (TAMPC) PROTECT.DOMAIN signal protectors, which blocks debugger's read and write access to all CPU registers and memory mapped addresses.

To check if APPROTECT is enabled, read the UICR.APPROTECT[0].PROTECT0 (0x00FFD000) and UICR.APPROTECT[0].PROTECT1 (0x00FFD01C) registers. If these registers have any value other than 0xFFFFFFFF, the device is protected. If the registers show the device as unprotected, write 0x50FA50FA to them.

The protection activates after a reset. Ensure all protections are configured before performing a reset if enabling ERASEPROTECT or SECUREAPPROTECT.

ERASEPROTECT

ERASEPROTECT blocks RRAMC ERASEALL and CTRL-AP.ERASEALL functionality.

To check if ERASEPROTECT is enabled, read the UICR.ERASEPROTECT[0].PROTECT0 (0x00FFD060) and UICR.ERASEPROTECT[0].PROTECT1 (0x00FFD07C) registers. If these registers have any value other than 0xFFFFFFFF, the device is protected. If the registers show the device as unprotected, write 0x50FA50FA to them.

The protection activates after a reset. Ensure all protections are configured before performing a reset if enabling APPROTECT or SECUREAPPROTECT.

SECUREAPPROTECT

Note: SECUREAPPROTECT is not available on nRF54LS05A and nRF54LS05B. See Device protection mechanisms.

SECUREAPPROTECT blocks debugger's read and write access to all secure CPU registers and secures memory mapped addresses.

To check if SECUREAPPROTECT is enabled, read the UICR.SECUREAPPROTECT[0].PROTECT0 (0x00FFD020) and UICR.SECUREAPPROTECT[0].PROTECT1 (0x00FFD03C) registers. If these registers have any value other than 0xFFFFFFFF, the device is protected. If the registers show the device as unprotected, write 0x50FA50FA to it.

The protection activates after a reset. Ensure all protections are configured before performing a reset if enabling APPROTECT or ERASEPROTECT.

Note: A cold boot through a pin reset or power cycling the device activates the TAMPC signal protectors even if the UICR APPROTECT registers are set to unprotected. In this case, protection can be disabled only through an ERASEALL operation. For more information, see Disabling APPROTECT.