My question is, why is driving by sight with speed limited (40 kmh afaik) not something that is enforced by the train itself when there is no connection to the other controls systems. How is that not a hard limit instead of something the train operator needs to remember?
Just inferring from GP, it sounds like the line was in an illegal/invalid state. Couple others are pointing out that the newer LZB system have much smaller block sizes than ASFA system it fell back to. Which means there were likely multiple trains under different LZB blocks occupying same ASFA blocks. That is a crash state, and train safety systems aren't designed to offer safe and normal operation of two already-crashed-on-paper trains.
What they needed to do was to move ALL trains around until the initial state is in a valid configuration under the ASFA system. Probably like moving one train at a time at <40kph so that there is minimum one ASFA block, which might be tens of miles or however long they are, between every single trains on the line. Then the whole operation could be switched to ASFA system at full speed at much reduced capacity. It also means the train more or less wouldn't be moving for the rest of the day. Not only passengers would be angry but there will inevitably few that needs to be hospitalized for things like mild dehydration and sometimes small injuries if they needed to be evacuated.
What likely happened was that they didn't think about any of that at all, and just hot rebooted into the ASFA system without deconflicting anything. The ASFA system signaled ok to proceed to all trains sharing the same ASFA blocks to their next vacant blocks, not knowing that some of blocks were occupied by multiple trains before humans put it online, which would be an out-of-question horrifying hypothetical to the ASFA computers. And when the system ordered a train in the block to stop because a block in front was occupied, there were in fact two trains in that block, one still driving towards the one in front at 160kph, far away from the stop signal, and two collided.
The thing that is enforced by the train when LZB goes down, is that the train stops. This seems to have worked correctly. Bringing a train from a stop to movement again is a potentially unsafe situation, and the situation is that the automatic system can't get movement authorities, so no safe system is going to do that automatically.
I understand that, but why can't the train self-limit to the 40kmh that the law requires when the security systems are down.