JPS63184145A - Device for recovering storage fault - Google Patents

Abstract

PURPOSE:To enable the automatic recovery control of the fault of a system, by providing an information holding means representing correspondence between the page frames of a main storage (MS) and an extended storage (ES), and means which updates the correspondence between the transmission origin and the transmission destination of information. CONSTITUTION:A central processor (CP)1 and an input/output processor (IOP)2 are connected to a system controller (SC)4 via signal lines 8 and 9. At lest either input/output device (I/O)3 is an auxiliary storage. The SC4 is connected to the MS5 via a signal line 10, and is connected to an MS/ES array 6 via a signal line 11. The SC4 controls the MS5, the MS/ES array 6, and the ES7 according to indication from the CP1 and IOP2. Data transfer between the MS5 and the ES7 is executed by the control of the SC4 through the execution of a page-in instruction and a page-out instruction by the CP1 or the IOP2.

Description

DETAILED DESCRIPTION OF THE INVENTION [Field of Industrial Application] The present invention relates to recovery from a failure in a storage device, and more particularly to a failure recovery device for a storage system having main memory and extended memory.

[Conventional technology]

A data processing system having an extended memory for paging in addition to a main memory is described in Japanese Patent Laid-Open No. 58-9276. This expanded storage (hereinafter abbreviated as ES) is mainly used as an intermediate hierarchical storage means between main memory (hereinafter abbreviated as MS) and auxiliary memory (hereinafter abbreviated as AS), and is Data transfer in page units is possible between the two. MS, ES and As
In a three-tier storage system consisting of a page transfer mechanism between these 3M layer storage media for page management,
A virtual addressing mechanism (eg, address translation means including a segment table and a page table) is provided.

Central processing unit! A virtual address specified by a program being executed by CP (hereinafter abbreviated as CP) is converted by a virtual addressing mechanism into a real page on the MS and a displacement within the page. During this conversion, if it is discovered that the requested real page does not exist in the MS, a paging operation is initiated. In the paging operation, a page-in operation is performed to transfer the required page from the ES or AS to the MS, and in many cases, in order to free up storage space for this new required page, the M
A page out operation is performed to purge one of the pages held in S.

If the required page exists in As, these operations are performed over the channel using the channel program. On the other hand, when the required page exists in the ES, synchronous transfer and asynchronous transfer have been proposed. In synchronous transfer.

Paging operations are realized by page-in and page-out commands issued by the CP.

These instructions specify the address in the ES and the address in the MS of the page to be transferred, and in the case of a page-in instruction, the page is transferred from the specified ES address to the specified MS address. .

In the case of a page-out instruction, the opposite transfer is performed.

On the other hand, in asynchronous transfer, the paging operation is performed by the channel program.

That is, a channel control word specifying a page-in operation and a channel control word specifying a page-out operation are prepared, and these channel control words are inserted at required positions in the channel program.

Page transfer between MS and ES is realized.

By the way, ECC (Err
or Correcting Code) is well known, and in the MS-ES storage system, M
It is naturally expected that each of S and ES will be provided with a failure recovery mechanism that utilizes FCC.

[Problem that the invention seeks to solve]

As is well known, the error correction ability of FCC has a limit determined by the relationship between the number of bits of FCC and the number of bits of data, and there is also a practical limit to the number of bits of ECC that can be adopted. Therefore, automatic recovery using ECC may fail. If automatic recovery by FCC fails, a machine check interrupt for one recovery failure occurs.

An object of the present invention is to provide an MS-ES storage system with an F
The purpose of this invention is to provide an opportunity for automatic recovery even for failures that cannot be recovered using conventional techniques such as CC, thereby improving the reliability of the system.

[Means for solving problems]

The present invention takes advantage of the fact that the MS and ES may hold the same page. That is, there is a correspondence information holding means that holds information indicating the correspondence between a fixed size area (for example, a page frame) between the MS and the ES, and when data is transferred between the MS and the ES, the contents of the correspondence information holding means are stored as a transfer source. means for updating to indicate the correspondence between the area and the transfer destination area, and when a failure is detected in one area of the MS or the ES, referring to the correspondence information holding means and using data in the corresponding area of the other. means to recover from the failure.

[Effect]

The contents of the correspondence information holding means are updated by the updating means each time a page-in operation and a page-out operation are performed, and indicate the correspondence between the MS area and the ES area that hold the same data. It is desirable to update the information to indicate whether or not it has been completed. When a failure is detected in one of the MS or ES, the correspondence information holding means is referred to to check whether the same data exists in the other. If the existence of the same data is discovered, it is used to recover from the failure.1For example, if a temporary failure is detected in the MS, data is transferred from the ES to it, and vice versa. ,E
If a temporary failure is detected in S, data is transferred from the MS to it.

Further, for example, if a fixed failure is detected in the transfer source ES or MS during a page-in operation or a page-out operation, the same data in the MS or ES is transferred to the transfer destination, respectively. Furthermore, in a system where a replacement MS area is prepared, if a fixed MS failure is detected,
Data in the ES is transferred to the alternate MS area.

〔Example〕

FIG. 1 shows an overview of an embodiment of the present invention, including a central processing unit (CP) 1 and an input/output processing bag! ! ! (IOP) 2 is the system control device via signal lines 8 and 9, respectively! (S
C) Connected to 4. 10P2 is connected to a required number of input/output devices (Ilo) 3.

Although not shown, at least one of these Ilo is an auxiliary memory (As).The SC4 is connected to the main memory (MS) 5 via a signal line 10, and the
It is connected to the S/ES array 6 and then to the expanded storage (ES) 7 via a signal line 12 . SC4 is CP
According to instructions from I and l0P2, MS5. MS/E
Controls S array 6 and ES7. MS/ES array 6
is a storage device for holding information indicating the correspondence between the MS and ES areas. The MS 5 includes a replacement MS area 34 for use in place of the area where a fixed failure has occurred.

Data transfer between MS5 and ES7 is described in the above-mentioned Japanese Patent Application Laid-open No. 58-
As described in Publication No. 9276, CPl or l
The execution of page-in and page-out instructions by 0P2 is carried out via signal lines 1o and 12 under the control of SC4.

FIG. 2 shows details of the embodiment shown in FIG. 1, however, 103 is omitted because it has no direct relation to the present invention.

CPl and l0P2 have means for activating access to MS5 and means for activating data transfer between 1M55 and ES7, and the MS address is connected to signal line 72 or 73.
The ES address is sent out through the signal line 74, and the MS write data is sent out through the signal line 75. M.S.
The data read from CPI 5 is transmitted via signal line 76 to CPI
Or sent to l0P2. MS write data register 50
is the read data from ES7 sent via signal 117'7 and the CPI or l0 sent via signal line 75.
One of the write data from P2 and the subsequent data from MS5 sent via the signal line 76 is selected and temporarily held.

It is then written to MS5. Data read from the MS 5 is temporarily held in the MS read data register 51 and transmitted from there via the signal line 76.

It is sent to ES write data register 52, MS write data register 50, CPI, and l0P2. The ES write data register 52 receives read data from the MS 5 sent via a signal line 76.

One of the read data from the ES7 sent via the signal line 77 is selected and temporarily held, and this data is then written to the ES7. The data read from ES7 is
It is temporarily held in the ES read data register 53, and then sent to the MS write data register 50 via a signal line 77.
and is sent to the ES write data register 52.

The data read from MS5 (signal line 76) and the data read from ES7 (signal 11A'l'l) are also
It is also sent to respective failure detection mechanisms 54 and 55. These fault detection mechanisms 54 and 55 include normal fault processing means such as ECC processing circuits, and when a fault that cannot be recovered by itself is detected, they investigate whether it is a temporary fault or a fixed fault. and send the result to signal lines 78 and 7.
9 respectively.

The MS write address register (MVAR) 56 and the MS read address register (MRAR) 57 are registers that store addresses for accessing the MS5, and the contents of one of them is selected by the selector 58 according to the operation specification. , used for MS5 addressing. During the MS-ES transfer operation, the address adder 59
The address used for addressing is changed for each transfer.
It is incremented by the transfer data unit amount and returned via the signal line 80.

The ES write address register (EVAR) 60 and the ES read address register (ERAR) 61 are registers that store addresses for accessing the ES7, and the contents of one of them is selected by the selector 62 according to the operation specification. , used for ES7 addressing. During the MS-ES transfer operation, the address adder 63 increments the address used for ES addressing by the transfer data unit amount for each transfer, and returns it via the signal line 81.

The MS/ES array 6 shown in FIG.
3 and its address register (MAR) 64, and E
The address register 64 of the MS array, which includes the S array 14 and its address register (EAR) 65, includes the MS5
The address used for addressing ES7 is set via a signal line 82, and the address used for addressing ES7 is set via a signal line 83 in the address register 65 of the ES array. The ES address on the signal line 83 is also set in the write data register 66 as write data to the MS array 13, and the ES address on the signal line 82 is set as write data to the MS array 13.
The S address is also set in the write data register 67 as write data to the ES array 14. The data read from the MS array 13 is stored in the read data register 6.
8 and signal line 84, the ES write address register 60
and is sent to the ES read address register 61. The data read from the ES array 14 is stored in the read data register 6.
9 and the signal line 85, the MS write address register 56
and is sent to the MS successive address register 57.

The replacement MS addressing mechanism 70 includes an address translation means for converting the address of the MS area in which a fixed failure has occurred to the address of the replacement MS area that replaces it, and
Alternatively, when the MS address sent from l0P2 belongs to the area where the fault exists, it is converted to the address of the corresponding replacement MS area. MS sent from cpi and l0P2
The alternate MS area address obtained by the address or conversion is sent to the MS write address register 5 via the signal line 86.
6 and is sent to the MS successive address register 57.

The MS write address register 56 and the MS read address register 57 are connected to the output of the address adder 59 (signal line 80).
, one of the outputs of the ES array 14 (signal line 85) and the output of the alternate MS addressing mechanism 70 (signal line 86) is selected and stored. The ES write address register 60 and the ES read address register 61 receive the address specified by CPI or l0P2 (signal line 74), the output of the address adder 63 (signal line 81), and the output of the MS array 13 (signal line 81).
One of the signal lines 84) is selected and stored.

The control mechanism 71 belongs to the system control device (SC) 4,
Upon receiving instructions from the CPI and l0P2, and further receiving the outputs of the failure detection mechanisms 54 and 55 (signal lines 78 and 79), various control signals are generated on the signal line group 72, thereby causing the MS5 and ES7 , as well as reading and writing of the MS array 13 and the ES array 14 .

FIG. 3 shows the contents of the MS array 13 and the ES array 14.
F) respectively associated MS array entries (M
Each MSAE is referenced by an address that corresponds to the address of its associated PF. The ES array 14 includes each unitary block (
ES array entry (EB) associated with each ES array entry (
ESAE) 16, each ESAE being referenced by an address that corresponds to the address of its associated EB.

FIG. 4 shows the validity bit V, which shows the contents of MSAE15.
indicates that the entry is invalid when it is 0'', that is, the data of the related PF does not exist in the ESV, and when it is 1'', it indicates that the entry is valid, that is, the data of the related PF does not exist in the ESV. The change bit C, which indicates that there is a possibility that the It is
1 pt indicates that there has been a change, and 0" indicates that there is no change yet. EBA indicates the address of a certain EB where data of the related PF may exist.

FIG. 5 shows the contents of ESAE16. validity bit V
If it is "1", it indicates that there is a possibility that the related EB data exists in the MS5.

“O” indicates that it is not present. P.F.A.

Indicates the address of a PF where related EB data may exist.

The contents of MSAE 15 and ESAE 16 are updated as illustrated in FIGS. 6-8 in response to execution of page-in instructions, page-out instructions, and other instructions that involve writing to MS5.

Figure 6 shows the MS when a page-out instruction is executed.
An example of updating AE and ESAE is shown. The pageout instruction is an instruction to transfer one page on the MSB to the ES7, and as described in detail later, the PF
Specify the address and EB address. When the pageout instruction is decoded, the CPI or l0P2 sends the PF address to the MS read address register 57 and the EB address to the ES write address register 60, and uses these addresses to write the ES from the MS. Data transfer to starts. At the same time as this.

The PF address is sent to the address register 64 of the MS array and the write data register 67 of the ES array via the signal line 82, and the EB address is sent to the address register 65 of the ES array via the signal line 83. Sent to write data register 66 of the MS array. As a result, P.F.
The EB address is stored in the MSAE selected by the address, and the PF is stored in the ESAE selected by the EB address.
For example, if pageout from PFO to EB2 is specified, as shown in FIG. 6, MSAEO will store V=1. C=0, EBA=EB
2, ESAE2 is set to v=-t, PFA=PF
Set to O.

Figure 7 shows the MSA when a page-in instruction is executed.
A page-in instruction showing an example of updating E and ESAE is as follows:
This is a command to transfer one page on ES7 to MS5,
As will be described in detail later, the ES address and PF address are specified as the operands. When the page-in instruction is decoded, CPl or l0P2 sets the EB address to ES
and the PF address to the MS write address register 56.

Data transfer from the ES to the MS is initiated using these addresses. At the same time, the MSAE selected by the PF address is
The EB address is stored in the ESAE selected by the EB address, and the PF address is stored in the ESAE selected by the EB address.
If page-in from B2 to PF2 is specified,
As shown in FIG. 7, MSAE2 has V=1. C=
O.

EBA=EB2 is set, ESAE2 is V;1, P
FA=PF2 is set.

FIG. 8 shows an example of updating MSAE when another instruction that changes the data of 1M55 is executed. In this case, the MS address specified by the executed instruction is
The address is sent to the address register 64 of the array, and the change bit C of the MSAE selected by this address is set to "1".

Other fields remain unchanged.6For example, if a data change is specified at a certain address in the PFI, the C bit of MSAEI will be set to “1” as shown in Figure 8.
is set to

Next, processing when a failure is detected will be explained.

FIG. 9 is a flowchart of processing when a failure occurs in the MS5. When the failure detection mechanism 54 detects a failure during a read operation from a certain MS address, the control mechanism 71
immediately stops this MS read operation and executes a failure recovery sequence according to the following procedure.

(1) From the MS address where the error was detected to the address of the page frame containing it (Error-PFA)
is calculated, and using this Error - P F A , the MSAE related to this page frame is calculated in the MS array 13
(20).

(2) Test the V bit in the read MSAE.

If ■=0, it is determined that recovery is not possible and a machine check interrupt is generated, and if ■=1, processing is continued (21).

(3) Test the C bit in this MSAE. C=1
If so, since the contents of 1MS have already been changed, it is determined that it is unrecoverable and a machine check interrupt is generated, and if C=0, processing is continued (22).

(4) Using EBA in this MSAE, ES array 1
ESAE is read from 4 (23).

(5) Test the V bit in the read ESAE.

If ■=0, it is determined that recovery is not possible and a machine check interrupt is generated, and if ■=1, processing is continued.

(6) PFA and terror-P in this ESAE
Compare F' A. If they do not match, it is determined that the data of the failed page frame does not exist in the ES, and a machine check interrupt is generated, and if they match, the process continues (25).

(7) Using the data in the ES block indicated by the EBA in the MSAE, the failure recovery process described below is performed (2
6).

FIG. 10 is a flowchart of processing when a failure occurs in the ES7.

(1) E including the ES address where the failure was detected
S block address (Error -EBA)
is determined, and the ESAE associated with this block is read out from the ES array 14 using this Error -E B A (27).

(2) Test the V bit in the read ESAE.

(2) If = 0, it is determined that recovery is not possible and a machine check interrupt is generated, and if V = 1, processing is continued (28).

(3) Using PFA in this ESAE, MS array 1
MSAE is read from 3 (29).

(4) Test the V bit in the read MSAE.

(2) If = 0, it is determined that recovery is not possible and a machine check interrupt is generated, and if V = 1, processing is continued (30).

(5) Test the C bit in this MSAE. C=1
If so, it is determined that recovery is not possible and a machine check interrupt is generated, and if C=0, processing is continued (31).

(6) EBA and Error-EB in this MSAE
Compare A. If they do not match, it is determined that recovery is not possible and a machine check interrupt is generated, and if they match, the process continues (32).

(7) Using the page frame data of the MS indicated by the PFA in the ESAE, the failure recovery process described below is performed (33).

Details of the failure recovery processing 26.33 in FIGS. 9 and 10 are as follows. First, if the failure is temporary and can be removed by rewriting the data, the failure will be recovered by the following process.

(1) For a temporary failure of an MS, the data of the ES block discovered by the process shown in FIG. 9 is rewritten to the page frame of the MS where the failure has occurred.

(2) For a temporary failure of the ES, the data of the page frame of the MS discovered by the process shown in FIG. 10 is rewritten to the ES block where the failure has occurred.

Next, a description will be given of recovery processing when the failure is fixed and cannot be removed by rewriting.

There are the following three cases of failures detected by the MS or ES, and recovery processing differs depending on the case.

Case 2: ES failure detected during execution of page-in instruction Case 2: MS detected during execution of page-out instruction
Failure case 3: For MS failure case 1 detected during the execution of other instructions, it is determined that the same data is retained by the process shown in Figure 10 instead of the ES block in which the fixed failure was detected. 11 schematically shows this process.
When page-in is to be performed from block 1 (EBi) 42 of S to page frame k (PFk) 40 of MS, a permanent failure is detected in EBi 42, and the same data as EBi 42 is retained by the process shown in FIG. Page frame Q (PFI2) 41 of the MS was discovered. Therefore, data is transferred from the PFQ 41 to the PFk 40 instead of the EBi 42, thereby normally completing the page-in operation.

For case 2, data is transferred from the ES block determined to hold the same data by the process shown in FIG. 9, instead of the page frame of the MS in which a permanent failure has been detected. FIG. 12 schematically shows this process. Page frame k (PFk
) 43 to ES block i (EBi) 44°, data is transferred from ES block Q (EBfl) 45 determined to hold the same data as PFk 43 to EBi 44, thereby performing a page-out operation. terminate normally.

For case 3, E discovered by the process shown in Figure 9
The data of the S block is transferred to the alternate MS area, and this alternate MS area is used in place of the page frame of the MS in which the fixed failure has been detected. FIG. 13 schematically shows this process. During the execution of instruction 46, page frame k (
A fixed failure was detected in PFk)47. Execution of instruction 46 is stopped, and ES block 1 (EBi) is determined to hold the same data as PFk47 through the process shown in FIG.
49 is transferred to the alternate MS area 48. Then, the instruction 46 executes the replacement MS area 49 instead of the PFk 47.
It will be re-executed with reference to and complete successfully.

An example of the alternate MS addressing scheme 7° in FIG. 2 is shown in FIG. Address input register 10
1 is connected to CPI or l0P via signal line 72 or 73.
Receives MS address from 2. The upper part of the address input register 101 is connected to a comparator (C
OMP) 103, and is also connected to a first input of a selection circuit (SEL) 107 via a signal line 109. The upper part of the MS address where the fixed fault has occurred is set in the register 100, and its output is connected to the other input of the comparator 103 via the signal line 110. The mode register 104 is normally set to "0", and is set to "1" in a mode in which the alternate MS area is used. The output line 111 of the mode register 104 and the match output line 112 from the comparator 103 are connected to an AND circuit 105, and the output line 113 of the AND circuit 105 is connected to the control input of the selection circuit 107.

The upper part of the MS address indicating the alternate MS area is set in the register 102, and its output is connected to the second input of the selection circuit 107 via the signal line 116. If the signal on signal line 113 is "0", select the signal on signal line 109, and if the signal on signal line 113 is "0", select signal line 113.
6 is selected and output to the signal line 114. The address output register 106 receives the output from the selection circuit 107 on the signal line 114 in its upper part, and receives the output from the selection circuit 107 on the signal line 115.
It receives the output from the lower part of the upper address input register 101 into its lower part, thereby forming the complete MS address therein. Address output register 106
The contents of are sent to the 1MS write address register 56 or the MS read address register 57 through the signal line 86.

In normal mode, mode register 104 is 110
Therefore, the selection circuit 107 selects the signal on the signal line 109, that is, the address input register 1
01 is selected, and as a result, the entire contents of the address manual register 101 are directly transferred to the address output register 1.
06 and is sent out. When a fixed failure occurs in the MS5, after the data is transferred to the alternate MS area as shown in FIG. The upper part of the address is set in register 102, and mode register 104 is set to 111 II.

In this mode, when the upper part of the address input register 101 and the contents of the register 100 match, the comparator 1
03 generates a coincidence output on the signal line 112, and the output line 113 of the AND circuit 105 takes a value of "1". Therefore, the selection circuit 107 selects the contents of the register 102, that is, the upper part of the alternate MS area address. As a result, the corresponding address in the alternate MS area holding the data restored to 1 is formed in the address output register 106.

FIGS. 15 and 16 show the formats of the page-in command and page-out command, respectively.

R1 and R2 each specify one register, the register specified by R1 holds the start address in the ES of the page to be transferred, and the register specified by R2 holds the start address in the MS of that page. hold. These addresses are incremented by address adders 59 and 63, respectively, synchronously with each read or write operation. The page-in operation code is read from ES and MS
The page out operation code instructs reading from the MS and writing to the ES.

The MS array 13 and the ES array 14 may each be independent storage devices or hardware register groups, or may be part of the MS. Yet another variation is to form part of it as a group of hardware registers and the rest of it as a group of hardware registers.
It may be accommodated in S.

The most practical structure is to place the C bits in the MS array in a group of hardware registers and the remainder in the MS. The reason for this is that it is desirable to speed up the setting of the C bit. The C bit must be set when executing a normal program instruction (for example, a normal store instruction), so if access to the MS is required to set it, processing speed will be significantly reduced. .

However, parts other than the C bit are handled only by page-in and page-out instructions.

Since each of these instructions normally transfers about 4 KB of data, even if an MS access for accessing the MS array and ES array is inserted between them, the effect on the overall processing speed is slight.

〔Effect of the invention〕

According to the present invention, in a storage system including an MS and an ES, it is possible to recover from at least a portion of a failure that cannot be recovered by conventional failure recovery mechanisms, and therefore, the reliability of the system is improved.

[Brief explanation of the drawing]

FIG. 1 is a block diagram showing an overview of an embodiment of the present invention, FIG. 2 is a block diagram showing details of the embodiment of FIG. 1, and FIG.
, a block diagram showing the correspondence of ESs, FIG. 4 is a diagram showing the format of entries in the MS array, and FIG.
The figure shows the format of an entry in the ES array, Figure 6 is a schematic diagram showing updates of MS array entries and ES array entries during page-out operations, and Figure 7 shows the MS array entries and ES array entries during page-in operations. A schematic diagram showing the update of an entry, FIG. 8 is a schematic diagram showing the setting of changed bits in the MS array entry, and FIG.
FIG. 10 is a flowchart of recovery processing for ES failure, FIG. 11 is a schematic diagram showing recovery processing for fixed ES failure, and FIG. 12 is a flowchart for recovery processing for fixed MS failure. FIG. 13 is a schematic diagram illustrating a recovery process for a fixed MS failure using a replacement MS area;
FIG. 14 is a block diagram showing an example of the alternate MS addressing mechanism in FIG. 2, FIG. 15 is a diagram showing the format of a page-in command, and FIG. 16 is a diagram showing the format of a page-out command. 4... System control device, 5... Main memory, 6 (1
3゜14.64-69)...MS/ES array (correspondence information holding means), 7...Expansion storage, 54.55...
Failure detection mechanism, 56-59... Main memory addressing mechanism, 60-63... Extended memory addressing mechanism, 71
...Memory control mechanism.

Claims (1)

[Scope of Claims] 1. A main memory, an extended memory as an intermediate hierarchical memory between the main memory and the auxiliary memory, and means for transferring data of a fixed size area between the main memory and the extended memory. A storage system comprising: correspondence information holding means for holding information indicating correspondence between the areas of the main memory and the expanded storage; an updating means for updating to indicate a correspondence between a transfer source area and a transfer destination area; a means for detecting a fault occurring in the main memory and the extended memory; and a detecting means for detecting a fault in one of the main memory and the extended memory. means for recovering from the failure by referring to the correspondence information holding means in response to the detection by using the data in the other area corresponding to the area in which the failure was detected. 2. In claim 1, the recovery means is a memory failure recovery device that transfers data in the corresponding area to the area where the failure is detected when the detected failure is a temporary failure. . 3. In claim 1 or 2, when the detected failure is a fixed failure detected in the transfer source area during the data transfer between the main memory and expanded storage, the recovery means: A storage failure recovery device that transfers data from the corresponding area to a transfer destination area instead of the area where the failure has been detected. 4. In Claims 1, 2, or 3, the storage system further comprises an alternate main storage area and means for converting an address of the main storage area where a permanent failure has occurred into an address of the alternate main storage area. A memory failure recovery device, wherein the recovery means transfers data in the corresponding area to the alternate main storage area when the detected failure is a fixed failure detected in the main memory. 5. In claim 1, 2, 3 or 4, the updating means further updates the content of the correspondence information holding means to indicate the fact that when the content of the area of the main memory has been changed, The recovery means is a memory failure recovery device that suppresses the recovery operation when the contents of the correspondence information holding means indicate the fact of the change.