nRF52840 locked with APPROTECT, unable to recover/flash without nRESET pin

[lassey0]

Hi,

I am working on a custom nRF52840 design (using nRF Connect SDK v2.9.3) and I have accidentally locked the chip via APPROTECT.

My major issue is that on this hardware revision, the physical nRESET pin (P0.18) is not routed out and is completely inaccessible.

I have tried recovering the chip using OpenOCD (nrf52_recover), which successfully executes the erase command (nrf52.cpu device has been successfully erased and unlocked), but immediately after the erase, OpenOCD fails with Could not find MEM-AP to control the core because it cannot perform a hardware reset. The chip then re-locks itself instantly on the next connection attempt.

I have compiled the new firmware with CONFIG_NRF_APPROTECT_USE_UICR=n, but I cannot flash it using probe-rs or OpenOCD due to this lock/unlock loop.

Is there any official way or special SWD sequence to permanently unlock and flash an nRF52840 (with the newer APPROTECT hardware) after a mass erase without having access to the physical nRESET pin?

Thanks for the help!

[Kenneth]

Hello,

Should be no need to access the reset pin no, you normally only need 4 pins: VDD, GND, SWDIO and SWDCLK. However it's important that you don't do any reset between eraseall and writing the new firmware, else it likely will enable again in between. I expect if you for instance use nrfjprog/nrfutil to program from command line it will work, or nrfutil/jlink from west. If you have access to an nRF52840-DK and use the 4pins from the debug out header that should work.

I guess one exception, if you by accident have enabled pin reset, and it somehow is pulled low (externally or by the code itself), then you are pretty much doomed without accessing the pin reset physically to pull it high.

Kenneth

[lassey0]

Hi Kenneth,

Thank you for the reply. To clarify, I am using a standard J-Link debug probe with 4 wires (VDD, GND, SWDIO, SWDCLK).

However, I am currently stuck in a deadlock situation:

1. When I run nrfjprog --recover (or equivalent nrfjprog --eraseall), the tool reports Recover failed and specifically complains about Access protection is enabled, can't read device version.

2. My J-Link debug logs show CTRL-AP indicates that the device is secured.

3. When the tool attempts to "unsecure" the device (which triggers the mass erase), it fails because it cannot reliably perform the required hardware reset or post-erase power cycle transition, likely because the internal APPROTECTstate is not clearing or the device is immediately re-locking before the debugger can regain control of the AHB-AP.

Since the nRESET pin is completely inaccessible on this custom PCB, I cannot manually toggle it to ensure a clean state post-erase.

My specific questions are:

• Is there a way to instruct nrfjprog or JLinkExe to perform the recovery without expecting a hardware reset or to force a specific "connect under reset" sequence that works purely via SWD protocol (e.g., using the CTRL-AP registers directly via J-Link script)?

• If the chip has reached a state where nrfjprog --recover fails with the -90: Access protection is enabled error, is there any J-Link script command that can bypass the "read device version" check and force the ERASEALL bit in the CTRL-APregisters?

• Are there any known quirks with nRF Connect SDK 2.9.3 or newer firmware revisions where the APPROTECT bits are behaving more aggressively than in older versions?

Currently, every attempt to recover or flash ends in the same -21 / -90 error loop. I have no way to pull the reset pin high or low. Is this board effectively bricked, or is there a specific J-Link "magic sequence" to recover an nRF52840 when the reset pin is missing?

Best regards,

Lasse

[Kenneth]

Can you try nrfutil for comparison? "nrfutil device recover"

Do you see the same if using the debug out from a nordic DK?

Kenneth

[lassey0]

nrfutil device recover
 Failed to recover 1050331232, Device error: Access port is still protected after Erase and Reset Error: One or more recover tasks failed:
* 1050331232: Device error: Access port is still protected after Erase and Reset (Generic)

[lassey0]

Lasses-MacBook-Pro  % JLinkExe SEGGER J-Link Commander V9.44 (Compiled May 20 2026 16:09:58) DLL version V9.44, compiled May 20 2026 16:09:23 Connecting to J-Link ...O.K. Firmware: J-Link OB-nRF5340-NordicSemi compiled Jul 8 2025 10:15:34 Hardware version: V1.00 J-Link uptime (since boot): 0d 00h 00m 06s S/N: 1050331232 License(s): RDI,FlashBP,FlashDL,JFlash,GDB USB speed mode: Full speed (12 MBit/s) VTref=3.300V Type "connect" to establish a target connection, '?' for help J-Link>connect Please specify device / core. <Default>: NRF52 Type '?' for selection dialog Device>nRF52840_xxAA Please specify target interface: J) JTAG (Default) S) SWD T) cJTAG TIF>S Specify target interface speed [kHz]. <Default>: 4000 kHz Speed> Device "NRF52840_XXAA" selected. Connecting to target via SWD InitTarget() start CTRL-AP indicates that the device is secured. For debugger connection the device needs to be unsecured. Note: Unsecuring will trigger a mass erase of the internal flash. Executing default behavior previously saved in the registry. Device will be unsecured now. InitTarget() end - Took 302ms Found SW-DP with ID 0x2BA01477 DPIDR: 0x2BA01477 CoreSight SoC-400 or earlier Scanning AP map to find all available APs AP[2]: Stopped AP scan as end of AP map has been reached AP[0]: JTAG-AP (IDR: 0x23000000, ADDR: 0x00000000) AP[1]: JTAG-AP (IDR: 0x02880000, ADDR: 0x01000000) Iterating through AP map to find AHB-AP to use AP[0]: Skipped. Not an AHB-AP AP[1]: Skipped. Not an AHB-AP Attach to CPU failed. Executing connect under reset. DPIDR: 0x2BA01477 CoreSight SoC-400 or earlier Scanning AP map to find all available APs AP[2]: Stopped AP scan as end of AP map has been reached AP[0]: JTAG-AP (IDR: 0x23000000, ADDR: 0x00000000) AP[1]: JTAG-AP (IDR: 0x02880000, ADDR: 0x01000000) Iterating through AP map to find AHB-AP to use AP[0]: Skipped. Not an AHB-AP AP[1]: Skipped. Not an AHB-AP Could not find core in Coresight setup InitTarget() start CTRL-AP indicates that the device is secured. For debugger connection the device needs to be unsecured. Note: Unsecuring will trigger a mass erase of the internal flash. Executing default behavior previously saved in the registry. Device will be unsecured now. InitTarget() end - Took 301ms Found SW-DP with ID 0x2BA01477 DPIDR: 0x2BA01477 CoreSight SoC-400 or earlier Scanning AP map to find all available APs AP[2]: Stopped AP scan as end of AP map has been reached AP[0]: JTAG-AP (IDR: 0x23000000, ADDR: 0x00000000) AP[1]: JTAG-AP (IDR: 0x02880000, ADDR: 0x01000000) Iterating through AP map to find AHB-AP to use AP[0]: Skipped. Not an AHB-AP AP[1]: Skipped. Not an AHB-AP Attach to CPU failed. Executing connect under reset. DPIDR: 0x2BA01477 CoreSight SoC-400 or earlier Scanning AP map to find all available APs AP[2]: Stopped AP scan as end of AP map has been reached AP[0]: JTAG-AP (IDR: 0x23000000, ADDR: 0x00000000) AP[1]: JTAG-AP (IDR: 0x02880000, ADDR: 0x01000000) Iterating through AP map to find AHB-AP to use AP[0]: Skipped. Not an AHB-AP AP[1]: Skipped. Not an AHB-AP Could not find core in Coresight setup Error occurred: Could not connect to the target device.