BQ27Z561-R1: ROM mode exit

Dear expert,

In customer board, 2/10 BQ27Z561 doesn't response any I2C command after some days test.

They access 0x16(8 bit address, 0xB 7 bit address) to see whether BQ561 stuck at ROM mode. 

Below pic is for command "W: 16 08 11". There is ACK for this command. 

But after below commands, BQ561 should exit ROM mode and response 0xAA (8 bit address, 0x55 7 bit address), but it is still NACK as pic2.

"W: 16 08 11
X: 4000"

Could you comment how to exit ROM mode?

And how BQ561 can stuck at ROM mode besides accident during downloading DFFS file?

Thanks

Pic 1: 0x16 access. ACK

Pic2: 0xAA access. NACK