I work in the industry, but have no knowledge of those particular Bosch/VW projects.
Yes the Tier-1 supplier is responsible for building the final software image that runs on their ECU, and for some smaller OEMs the Tier-1 will write all the application software in addition to the basic platform software. However, it's not unusual for the bigger OEMs (such as VW) to develop parts of the application software themselves and provide it as object code for the Tier-1 supplier to link. This is effectively a black box as far as the Tier-1 is concerned.
Bosch is providing the hardware with a base software which is tuned/modified by the manufacturer.
Think of it like an Arduino with a bit of software to control the opening/closing of your house door. You get in the package the hardware + example/working software and then you are free to improve it to let say, open the door if your own custom made dog detector connected to the Arduino is detecting that your dog is in front of the door.
> Bosch is providing the hardware with a base software which is tuned/modified by the manufacturer.
All the information that I have found so far says that the engine manufacturer cannot change the software, just tweak parameters. Which means that the original test drive curve detection was provided by Bosch. This also makes sense given the fact that Bosch wrote a statement upon delivery to VW that they could not use that detection code for emission cheating.
People did reverse engineer the Bosch software[1]. And it's entirely data driven. In short, you program it by tuning/changing its parameters, or as was the case with dieselgate, loading different drive profiles into the ECU.
that over simplifies it a bit...there are likely hundreds of maps (effectively N-dimensional lookup matrices) and thousands or tens of thousands of variables and parameters. The difference is more akin to firmware/software.
Unless you have inside knowledge of the project, it is very difficult to determine who actually wrote the code.
In a typical modern car, there are probably more than 30 different companies providing software components into the car. Sometimes, in a single black box with complicated fucntions, there could be 5 software companies contributing.
So it is unsurprising of confusing story that Audi has been put foward as the source of the "dieselgate" software whereas before Bosch was the source.