  Autonomous Driving Systems (ADSs) are complex Cyber-Physical Systems (CPSs)
that must ensure safety even in uncertain conditions. Modern ADSs often employ
Deep Neural Networks (DNNs), which may not produce correct results in every
possible driving scenario. Thus, an approach to estimate the confidence of an
ADS at runtime is necessary to prevent potentially dangerous situations. In
this paper we propose MarMot, an online monitoring approach for ADSs based on
Metamorphic Relations (MRs), which are properties of a system that hold among
multiple inputs and the corresponding outputs. Using domain-specific MRs,
MarMot estimates the uncertainty of the ADS at runtime, allowing the
identification of anomalous situations that are likely to cause a faulty
behavior of the ADS, such as driving off the road.
  We perform an empirical assessment of MarMot with five different MRs, using
two different subject ADSs, including a small-scale physical ADS and a
simulated ADS. Our evaluation encompasses the identification of both external
anomalies, e.g., fog, as well as internal anomalies, e.g., faulty DNNs due to
mislabeled training data. Our results show that MarMot can identify up to 65\%
of the external anomalies and 100\% of the internal anomalies in the physical
ADS, and up to 54\% of the external anomalies and 88\% of the internal
anomalies in the simulated ADS. With these results, MarMot outperforms or is
comparable to other state-of-the-art approaches, including SelfOracle,
Ensemble, and MC Dropout-based ADS monitors.
