Looking at Table 40 in the nRF51 Series Reference Manual v3.0, the Memory Protection Unit prevents request sources in Code R1 from writing to RAM R0. But if the request source is in RAM R1, it is allowed full read and write access to RAM R0.
On the nRF51822, does this mean that a program running in Code R1 could copy a routine into RAM R1 and then execute it in order to write RAM R0?
Update 14.06.2016:
In the below table from the Reference Manual, RAM R1 is shown to have Full Access to RAM R0 regardless of MPU configuration. Is this correct?