Did anyone else notice this choice comment: “They just figured it’s part of the normal instability of the system,” Weiss told Wired.com. “But it wasn’t until the SCADA system actually turned on and off that they realized something was wrong.” That's a pretty bad sign that the system is so buggy that at first it seems like a hacking attempt is just "normal" instability.
Anybody that's worked with SCADA systems unfortunately wouldn't bat an eye at this. In my own experience they're horribly issue prone, we've churned through 4-5 different vendors in the last 3 years trying to get past basic stability issues.
Unfortunately, writing plc code is like writing in assembly with global access to variables. Unless you test things thoroughly it's really tough to have a system run bug free. Thankfully, most of the processes are pretty simple so its not exceedingly hard to test it.