Most places already have a way around this in the inclusion of a "Knox box" on the side of house, near a door. Mostly used in commercial applications, but they are starting to show up in the residential area as well. It works by placing an armoured, keyed box near the door which is tied into the alarm system. When a fire breaks out, the FD shows up, opens the Knox with the Agency's master key, trips the alarm, then unlocks the door and enters. If the building is burning enough that they can't open the box and then open the door, hitting it with an axe and providing fresh air for the fire is going to be a bad idea in the first place.
Next time you're at the shopping center or store of your choice, look near the doors for the little metal box with a bit of red reflective tape on it, that's the Knox Box.

While the redundancy is built into the system to allow the call to go somewhere, it may not be a place that can handle the call the best. We try to build the systems to account for these failovers, but even then, calltakers/dispatchers will start working on a sort of "muscle memory" when things get bad and busy. Just because the 911 phone is answered, doesn't mean that the ambulance/fire brigade/armed posse is within easy grasp. It's not as simple as adding capacity if the extra capacity is just as unaware of the layout of the area they are serving, and you can only drill on these situations so much.

For example: Assume CityA and CityB. CityA is a rather large city with 250k people. CityB is a fair-sized city with 100k people. PSAP for CityA goes dark and fails over. A call is receieved for 203 Main St. in CityA for a 911 hangup/Check Welfare. Since the system has failed over, This call is now being handled by the PSAP for CityB. CityB also has a 203 Main St. The calltaker sees on their display that there's a call for 203 Main St and puts that address in the CAD. CAD finds 203 Main St and the dispatcher send the police to do a welfare check at that address. CityB Police get there, nothing to be found, and the call is closed out as unfounded. After a few minutes, another call comes in for CityA's 203 Main St. (Remember during this time that CityB has been processing their own call volume as well, which can be quite substantial, as CityB's PSAP was not structured to handle the call volume for CityA as well.) At this point, dispatch has their first "red flag" moment and realizes that they need to mentally switch over and send CityA Police to check the area. Luckily, this case would be a kid playing with the phones, but it could turn out very different if this were for say a heart attack, or some active crime in progress.

Oh how I wish the redundancy planning for these particular systems were so well thought out, and some are (One agency I know of has a full hot-standby PSAP built that can be staffed and processing in about 10 minutes, they actually test this on a regular basis), but a lot of other, usually smaller sites or very large sites, simply flip the switch and shunt the calls to neighboring PSAPs to handle the load, with the results of the example above, until they can finally get their disaster plan options up and running.
Mostly, this is a matter of cost and, as has been mentioned before, everybody wants 911 answered on the first ring, but nobody wants to pay the taxes needed to make that happen, which usually only comes up when you get that nice "All circuits are busy" message, or the dreaded busy signal on when you dial 911 (Both of which can and do happen in some areas).

Definitions:

• PSAP - Public Safety Answering Point (the place the phone rings)
• calltaker - the person that talks to the public that is calling in
• dispatcher - the person that tells the cops where to go (I love saying that)
• CAD - Computer Aided Dispatch (This has very little to do with drawing things beyond basic GIS, even though spamers think it does)

Try here

Problem is, that's not really the whole story. In a corporation, those executives don't just get to name a salary, a board of directors usually has to approve the deal, and those board members are, in most publicly-traded companies, then responsible to the shareholders. If they sign a bad contract, then at the next shareholder meeting, they could find themselves out of a directorship. All it takes is that the shareholders start reading the packet they get in the mails about what is going on, and then take an active role in deciding how to cast their votes.

They generally use mechanism of injury to determine the set of questions that are relevant to ask as well as guiding your initial response. Determining the actual response priority is still based on the nature and severity of injury. Example: you would ask different questions of a caller who's first words are "I feel dizzy and the room smells like gas" than someone that calls up with their first words being "Oh my god, he just got stabbed." Both very easily could be critical issues, but have different information needed and different things the call taker can tell them to do (Get out of the house NOW and don't touch any light switches, versus Don't pull out the knife and/or keep direct pressure on the wound). Both get someone there post-haste, but one also brings the police who go in first so medics don't get stabbed too, the other the fire department who go in first so medics don't recreate last year's 4th of July display if they happen to cause a spark.

While close, these aren't really measuring the same things. One is looking at time to patient contact the other time to transport capability. In the UK example, if I can get a medic to the patient in 6 minutes by putting him/her on a bicycle to get through hte London streets and crowds, the clock would stop as soon as they are on scene and can start treatment, and determine the need for a transport unit. Conversely, in the US example, if I do the same thing, and have a 6 minute time to get a medic to the patient in the middle of Times Square in New York City, my clock is still running until I get an ambulance there that can load the patient up and get them to the hospital whether they need to go to one or not. It may be a little pedantic, but in the US, these statistics and numbers determine funding and thus how you ask the question matters a great deal. As far as which is the better method, well, that starts to get into the realm of opinion.
On another note, while those US numbers may be common, you have to also remember that each jurisdiction can pretty much set their own response time goals based on the guidance their state's certifying authority, and they vary widely based on where you are. In the US, there isn't really a single, overall, national-level authority as to what those times should be, except maybe the US Department Of Transportation (yeah, I'm still trying to figure why that one is still in charge of guiding national policy EMS since they really naturally excel in determining the definition of an ambulance, which makes about as much sense as giving the USGS the job guiding vitamin and mineral supplement policy based on the logic that your iron supplement pills were rocks at one point.) In the UK, you have a group that logically follows to set those goals and influence policy in the NHS, which deals specifically with health and medical standards for the entire nation. Determining the quality of that oversight, however, exceeds the scope of my comments and is left as an exercise for the reader to consider, preferably off-line and a great distance away from me.

No, no, no. Those questions are in the newer release with the pandemic flu/SARS cards. That costs extra. /sarcasm

One fundamental part of using these Medical Priority Dispatch Systems, especially the software-based systems used in the US is that the dispatcher/call taker is presented the option at the end of the KQ (Key Question) section with a set of choices (or earlier if the situation warrants it). If we use your example list above with the fall et. al. you'd normally get: 30D01: Trauma to dangerous Body Area, 17B03: Fall of unknown distance, 21B03: Bleeding Disorder, or 17D00: Fall - Override to choose as the primary determinant (Loss of limb already has forwarded the call to dispatch since that's a delta response anyway, but we'll overlook that part for the moment.) That *D00 code lets the dispatcher say "Hmmm. The computer is saying this isn't a high priority, but something here isn't fitting with common sense/reality, so I'm upgrading the priority and changing this determinant based on my training and telling dispatch this is the higher priority." No matter how good the software is, you take out the human element and you will have problems.

The only "software" problem I've ever encountered, and what the original Telegraph article seems to casually allude to be the crux of the case here, is that almost all of these systems allow the end user (dispatch centre director/administrator/government committee) to modify the decision tree to meet their "needs" without enforcing the common sense rules they started with when the software was implemented. When used as designed, as soon as the dispatcher entered she wasn't breathing normally (usually question #3: How is the person breathing? Answer = Agonal Breathing = immediate configuration of call to a 17D04 Fall - Abnormal Breathing), the call would automatically re-configure to a Delta priority and in most systems is automatically forwarded to a dispatcher with the information up to that point for immediate dispatch of an EMS crew.

Going back to the poster's example, the loss of limb would have triggered that re-configuration to a Delta Response and started a dispatch immediately as loss of extremity = 21D01 - Dangerous Haemorrhage. Again, the end user can configure these responses to a different coding, but only after being prompted several times, in a separate configuration menu that requires an administrative password to even access let alone change anything, that this isn't how the system is designed to work and reminding them they could loose their MPDS certification if they continue.

The problem isn't so much the software as it is the implementation and oversight. There are times when you want to change the decision tree (your jurisdiction decides that a call for chest pain is getting a C-response regardless of patient age, onset, or breathing status (Usually because the people that fund you, or worse, their lawyers, want someone going blinky-blinky, woo-woo down the road any time someone has a pain in their chest). Other areas don't use the Omega protocol level for obvious signs of death because people listening on scanners know what that means and the TV crews might beat the ambulance to the scene of the carnage (and yes, I've seen that one happen before).

Disclaimers:
1) Depending on what MPDS system you use, the card numbers and modifiers may be different than those shown here.
2): This is all based on the US implementation of MPDS as it was developed for and is implemented in the American 9-1-1 system where the following is true: The first number, the determinant, gives basic type of response (17 - falls, 21 -Haemorrhage) The letter indicates priority, given as Alpha through Echo with Alpha being lowest priority (I gotta hangnail) and Echo for eminent death (Blood is shooting out of his neck in pulses) and the occasional Omega for Obvious DOA (Ummm where's the head that goes with this body). Finally the last number, the modifier, serves to provide more information about what kind of call the crew is running to (He fell out of his chair, he fell down the stairs, he was skydiving and his parachute didn't open).
3): I am not now, nor have I ever been employed by a developer or provider of MPDS systems, either software or card based, but I have worked on implementing and supporting systems that integrate with said MPDS systems.
4) All situations are different and I'm not an expert (but I have stayed in a Holiday Inn Express) and you should consult more qualified persons before taking anything listed here (or anywhere else, for that matter) as the gospel truth. If you do use what I say for anything in a production environment and haven't paid for said advice, all I will guarantee is that I will stand back at a safe distance and laugh at you when it all goes tits-up.

I worked as an intern for a municipal government IT department a while back, and had to do a site visit to a water filtration/pumping station. While I was there, I wandered down to one of the areas where the machines were that ran the pumps, valves, and other sundry devices. I found the workstation where two computers had been installed, one on the network to allow employees access to email, the intranet, and the internet. Beside it was another computer, which controlled the SCADA system for the plant and had root access to the entire city's water and sewer SCADA system. The plant manager assured me that they were totally seperate, and never the two should mix. Well, imagine my shock and surprise when I walked past the desk and tripped over a bright yellow patch cable that ran from the second (standby) network card into a small hub, that also fed the public terminal and then went to the internet port on the wall. I made a few notes, checked a few log files, then went and told the manager that the hub had to go and went back to the main IT office and reported. The answer I got? "So what? What could someone do with that?" As a demonstration, I took my noted, typed a few commands, and put a few nice words on top of the Wunderware logo on the terminal, then told the plant manager, who was still saying this was impossible, to check the screen. Turns out, an employee in the plant decided it was too much trouble to go between the computers, took the hub from a conference room upstairs, and made the connection. I wonder what might have happened if I opened that Cl2 valve or maybe closed a high pressure sewage line at the treatment facility? The weakest link in these systems is not the SCADA systems themselves, so to speak, but the people that use them daily, and managers that don't bother to look at the equipment on a regular basis, just to make sure it still looks like that nice drawing in the office.