It spread first as windows worm that exploited several 0-days. If the host didn't have the Siemens PLC device drivers with a configuration that matched the exact configuration of what they were expecting for the centrifuges, they payload was dormant and it just replicated. Only if it matched would it patch the PLC's programming upon re-connection to fake reporting that the speed was normal while it was actually spinning out of control.