Q:

How do NFC prevent from re-written when READONLY is set

I'm looking for a formal answer to why once a NFC tag has had its bit set to read only, that is cannot be changed. What causes this effect to be irreversible? I've tried searching online to no avail. Its purely for curiosity purposes.
My initial thoughts are that this is done mechanically: that once set to read only, it breaks the channel to be written to.
I recently got well over 1000 NFC215 chips and about half that amount of NFC216 chips as well all from a bin at uni (Filled my entire rucksack!) and was playing around with android studio, and I'm trying to put them to a cool project but I just wanted to know how these items worked technically. 
I'm a computer science student, so don't be afraid to go technical :)
Also any other resources about the specification / datasheet about the chips would be most appreciated.

A:

Likely you've got NTAG215 and NTAG216 cards from NXP. You'll find the data-sheet online.
They implement their write protection using lock bits that can be written once but never erased. How they did that on the chip level is not documented. It could be a hardware feature where you have little silicon junctions working as fuses. If you set the lock-bit you blow the fuse and write access is gone forever. It could otoh be implemented on a firmware level. Your chances to make them writable again are zero though.
However, you may still be lucky. Write protection happens per page and the tags have multiple pages to work with. I'd start dumping all pages and see if you find unprotected pages. In practice that is often the case because whoever wrote the cards may want to keep the door open for future extensions.

