Reverse engineering LIN bus on E-bike system As a project I am trying to 'hack' an old E-bike.
The electronic system of the bike consists of:

A torque sensor measuring deformation of the rear.
A 'spin' sensor measuring if the person is pedeling.
A battery pack with BMS
A speed controller inside the hub motor.
A display to control speed, lights and display distance information etc.

From researching I concluded that the sensors, dislay and speed controller are communicating over LIN because they have a ATA6661 LIN transceiver and they are all connected parallel over the VS, LIN and GND wire.
When I power up the speed controller on its own I can see some LIN communication on my oscilloscope:

I do not have a LIN transceiver to log the data but I attached a USB-TTL transceiver to the uart-side of the LINtransceiver. From my oscilloscope a deduced that the baud rate was 9600. I used termite to listen on my serial port and set it to hex view. This is what I got:

I'm not sure if I should change the amount of bits or parity bits.
My goal is to understand the frames that are send and to deduce which frame holds which sensordata or results in a certain activity.
When I compare this to an CANbus project I was doing it was fairly easy to for example deduce which command was controlling my car's left window because with can-utils (candump) I could see every packet. I could filter unchanged packets and it colorcoded which bit(s) in each packet recently changed.
Any advice/ideas on how to do this for LINbus?
As a starter point I would hookup your rigol ds1054z via usb to sigrok
https://sigrok.org/wiki/PulseView this will enable you to log dump and analyze your lin frames . It has a frame decoder for LIN protocol.
This should give you a great view of what is transiting over the lin bus and which slave PID to call .
From there you may use a macchina.cc  to comunicate over lin or use
https://github.com/macchina/LIN with a arduino due and a lin tranceiver.
Cheerz