Checking if APPROTECT is enabled

nRF91 Series Production Programming

The Control Access Port (CTRL-AP) is a custom access port that enables control of the device even if other access ports in the Debug Access Port (DAP) are disabled by Access Port Protection (APPROTECT).

If access port protection has been enabled in the APPROTECT register (0x00FF8000) of the User Information Configuration Registers (UICR), the debugger's read/write access to all CPU registers and memory mapped addresses is blocked.

For more information about CTRL-AP, see nRF9151 CTRL-AP - Control access port, nRF9160 CTRL-AP - Control access port, or nRF9161 CTRL-AP - Control access port.

Use the standard Serial Wire Debug (SWD) Arm® CoreSight™ DAP protocol to check if APPROTECT is enabled.

  1. Select or connect to the control access port.
    This access port is at index 0x04. See nRF9151 DAP - Debug access port, nRF9160 DAP - Debug access port, or nRF9161 DAP - Debug access port.
  2. Read the APPROTECT.STATUS register (0x00C) of the CTRL-AP.
    If the bit at position 1 of this register is 0, APPROTECT is enabled.
    If the bit at position 1 of this register is 1, APPROTECT is disabled.
  3. Read the ERASEPROTECT.STATUS (0x018) of the CTRL-AP.
    If the least significant bit of this register is 0, Erase Protection (ERASEPROTECT) is enabled.
    If ERASEPROTECT is set, it can be disabled if the installed firmware and the debugger both write the same non-zero 32-bit KEY value to ERASPROTECT.DISABLE (0x01C).
    Note: If APPROTECT and ERASEPROTECT are enabled and the device does not have firmware that allows disabling ERASEPROTECT, the device is locked and cannot be recovered.
  4. Go to Erasing all.
    If the least significant bit of this register is 1, access port protection is disabled. Go to Halting the CPU.