It seems the malware was installed on an engineering workstation connected to a SIS (Safety Instrumented System). https://en.wikipedia.org/wiki/Safety_inst

It seems the malware was installed on an engineering workstation connected to a SIS (Safety Instrumented System). https://en.wikipedia.org/wiki/Safety_instrumented_system The only purpose of a SIS in a CPS (Cyber Physical System) is to take over and bring the plant/processes down safely when things go wrong but before they get out of control. So it seems it did its job here. The big question is how the malware got onto the engineering workstation to begin with. These are usually very segmented (firewalls, data diodes, etc.)