The satellite probably has two processor modules. With A being active the software image for B gets uplinked via telecommands and then written to memory. Then the satellite is being rebooted using processor module B with the new software. If it does not work it will reboot again to A with the help of a watchdog. But if everything works, the software for processor module A can be updated then.
Something like that I would suspect.
Edit: disregard what I wrote, the article is about an update for the instrument and I thought it was about the satellite. But he Flight User Manual is available: https://archives.esac.esa.int/psa/ftp/MARS-EXPRESS/MARSIS/ME...