BQ76952: How to enter CONFIG MODE ?

Tool/software:

Hi everyone, 

I can't enter to config mode with the BQ76952, in fact, I can't write anything to the registers. I've done various test and all registers stay same. The 0x00 Control Status() command returns this value "10010100000000" and 0x12 Battery Status() returns this "1111110010001100" and sometimes it switches to this value "1100010010000100 " . I'm using ESP32 with I2C

I would very much appreciate any help. Thanks :)

#include <Wire.h>

// BQ76952 I2C address (7-bit)
#define BQ76952_I2C_ADDR 0x08

void setup() {
  Serial.begin(115200);
  Wire.begin(21, 22, 400000); 

  delay(2000);

  uint16_t subcmdStatus = readWord(0x00);  
  Serial.print("Subcommand Status (0x00): ");
  Serial.println(subcmdStatus, BIN);  /

  uint16_t batteryStatus = readWord(0x12);
  Serial.print("batteryStatus (0x12): ");
  Serial.println(batteryStatus, BIN);

  delay(500); 

  enterConfigUpdateMode();
}

void loop() {
  delay(1000);  
}

uint16_t readWord(uint8_t reg) {
  Wire.beginTransmission(BQ76952_I2C_ADDR);  
  Wire.write(reg);                           
  Wire.endTransmission(false);               

  Wire.requestFrom(BQ76952_I2C_ADDR, 2);  
  if (Wire.available() == 2) {
    uint8_t lsb = Wire.read();
    uint8_t msb = Wire.read();
    return (msb << 8) | lsb;  
  }
  return 0xFFFF;  
}

void enterConfigUpdateMode() {
  writeSubcommand(0x0090);  // ENTER_CFG_UPDATE
  delay(100);

  // Wait for CFGUPDATE bit to be set in BatteryStatus (0x12), bit 0
  bool entered = false;
  for (int i = 0; i < 50; i++) {
    uint16_t batteryStatus = readWord(0x12);
    Serial.print("batteryStatus (0x12): ");
    Serial.println(batteryStatus, BIN);
    if (batteryStatus & (1 << 0)) {
      Serial.println("Entered CONFIG_UPDATE mode.");
      entered = true;
      break;
    }
    delay(100);
  }

  if (!entered) {
    Serial.println("Failed to enter CONFIG_UPDATE mode.");
  } else {
    delay(1000);
    writeSubcommand(0x0092);  // EXIT_CFG_UPDATE
    delay(100);
    Serial.println("Exited CONFIG_UPDATE mode.");
    delay(1000);
    uint16_t batteryStatus = readWord(0x12);
    Serial.print("batteryStatus (0x12): ");
    Serial.println(batteryStatus, BIN);
  }
}

void writeSubcommand(uint16_t command) {
  Wire.beginTransmission(0x08);               // Correct I2C address (0x08)
  Wire.write(0x3E);                           // Subcommand register (0x00)
  Wire.write((byte)command & 0x00FF);         // LSB
  Wire.write((byte)(command >> 8) & 0x00FF);  // MSB
  Wire.endTransmission();
  delay(10);  // Short delay after sending
}