A Satellite Operational Procedure (OP) consists of a set of instructions reading information from the satellite (telemetries, TM) and sending commands to it (telecommands, TC). An OP can be executed by a human or by a computer (on-board procedures). Typically OPs are mission critical systems since their failure may entail hardware damages, degradation of satellite services or costly human based recovery actions. For this reason OPs are typically thoroughly tested in order to have reasonable assurances about their correctness. Unfortunately, traditional simulation based verification of OPs is highly expensive, since it requires a high amount of time from highly skilled personnel and does not provide formal assurance about the correctness of the OP under verification.We show how a model checker (CMurphi) can be used to drive a satellite simulator (namely, SIMSAT). The proposed approach has the following benefits. First, it improves OP quality assurance by automatic exhaustive exploration of all possible simulation scenarios whereas a manually driven simulation campaign cannot offer any formal assurance on the coverage achieved by the simulation campaign. Second, it decreases OP verification costs by using a model checker to automatically drive (via fault injections) the simulator. The model checker will record the considered simulation scenarios and automatically generate fresh (i.e., not previously considered) scenarios automatically stopping when all meaningful scenarios have been considered. Third, our approach allows humans to focus on the design of disturbance models (e.g., how many faults it makes sense to consider, when such faults may occur, etc.) which are highly reusable across verification of similar OPs.We implemented a prototype system by interfacing the CMurphi model checker to the SIMSAT simulator. Our experimental results show the feasibility of the proposed approach.