A data processing apparatus (30) comprising: a local source of data (4); a first controller (31); and a tamper-resistant second controller (32) configured to communicate with the first controller, the first controller being configured to control and receive data from the local source of data and from a sensing unit connected to the first controller via a communication interface and to perform a series of calculation operations on the data, wherein the second controller is configured to verify the integrity of a selected subset of the operations performed by the first controller.