After playing with the service menu I can add the following information.
1. The clock (Rtc) option is completely useless: once set, it never advances as time passes, and it is completely forgotten when power is lost. Indeed, the only information about the clock stored in the data-EEPROM is a single bit indicating whether to show it or not.
2. The bit controlling the display of the clock, as well as the bit controlling the two options under the "Comm" menu are stored (together with the bit flagging whether the bar-graph is "standard" or "ultrafine" -- see OP) in the low nibble of the byte at address 01, as follows:
Communication serial mode is stored in bit 1. It is 0 for "On Event" and 1 for "polled".
Clock display is stored in bit 2. It is 0 for "off", and 1 for "on".
Bar graph scale is stored in bit 3. It is 0 for "standard" and 1 for "ultrafine"
Thus, for example, if all flags are set the low nibble at address 01 will be 0E.
3. The "Cal" option in the service menu is responsible for all the rest of the data-EEPROM non-zero bytes except for the first 4 bytes. Using a glass of cold water to dip the tip in I managed to draw enough power (readings in the 600s) to allow me to get the option to also set the "Cal Hi Poi..." that eluded me before (see previous message in thread). Note that there was no real way for me to chose a particular number to set as the power-draw was constantly changing, so the calibration was to basically random values in the allowed range. I Have performed a calibration of all three points (the unit does not save anything unless all points are done together), and then read the data-EEPROM, and then reset it. I repeated this 3 times, with the following results:
00 00 09 01 D6 12 85 3A 5D F4 11 BF 00 00 5C 42
00 00 09 01 45 76 8C 3A CB B0 18 BF 00 00 5C 42
00 00 09 01 48 A4 6E 3A 22 17 03 BF 00 00 5C 42
For comparison, here is the state after a reset:
00 00 09 01 07 16 93 B8 54 20 4E 3E 5F 01 22 C1
Observe that:
a. Each calibration completely rewrote the values in addresses 04 to 0F.
b. Addresses 07, and 0B to 0F were written to the same values on all three attempts, thus only 6 bytes are different between different calibrations. This looks reasonable since the number presented on the LCD (and presumably stored) for each of the three points is a 4 digit decimal number (however, the low-point number was less than decimal 100 - which would indicate at least one 00 byte, so the encoding is probably not direct, but translated to the domain of the LCD control).
c. Addresses 00 to 03 were unchanged - this was to be expected for addresses 00 to 02, but leaves the question open as to what is the 01 at address 03 is used for.
The most interesting point is that a fourth calibration attempt yielded very similar results except that it also wrote FF to address 01, thus completely confusing the unit as to which channel(s) had a hand-piece connected to it.
In summary, it looks like most of the service menu is half-baked, and probably the only useful option is the "reset".