## 2 Signal Model  
The CMMB signal and pseudorange noise (PRN) codes are multiplexed in the same frequency band. Figure 1 shows the structure of the TC-OFDM signal. The duration of each frame of the CMMB signal is 1 s, and each frame consists of 40 time slots. The duration of each time slot is 25 ms. The CMMB system uses orthogonal frequency division multiplexing (OFDM) to transmit the broadcasting signal. Two kinds of pseudo codes are superimposed on the CMMB signals to provide high accuracy positioning services, which are named short codes and long codes, respectively. The beginning of the frame has the TxID and two synchronization signals. The TxID is empty in the practice CMMB signal, so the short codes are superimposed on the TxID to distinguish different base stations by using different pseudo codes signals. Thanks to the fact the TxID is empty, the short codes and the CMMB signals have the same transmission power. In order not to affect the normal communication of the CMMB signal, the power of long codes is lower than the CMMB signal by 20 dB [10]. In the positioning, the receiver uses short codes to achieve acquisition and long codes to achieve stable tracking. Figure 1: TC-OFDM signal Frame Structure. The TC-OFDM signal of the \(n\)th time slot can be expressed as:  
\[s_{k}^{(i)}(t)=\left\{ \begin{array}{ll}s_{CMMB}(t)+c_{SC}^{(i)}(t)&(k-1)T_{F} \leq t<(k-1)T_{F}+T_{\text{SC}}\\ s_{CMMB}(t)+\alpha c_{LC}^{(i)}(t)&(k-1)T_{F}+T_{\text{SC}}\leq t\leq kT_{F}\\ 0&\text{\emph{others}}\end{array} \right. \tag{1}\]  
where the \(S_{CMMB}(t)\) is the CMMB signal, \(C_{SC}(t)\) and \(C_{LC}(t)\) is short codes and long codes respectively. The superscript \(i\) represents the base station number. \(T_{F}\) is the time length of the time slot and \(T_{\text{SC}}\) is the time length of the short codes. The term \(\alpha\) is the signal attenuation factor. In order to transmit the positioning-assisted information, the PRN codes sent by the base station are modulated with the positioning-assisted information, and each slot modulates one bit positioning-assisted information. The TC-OFDM signal of \(i\)th base station can be written as:  
\[s^{(i)}(t)=\sum_{k=-\infty}^{\infty}d^{(i)}(t)s_{k}^{(i)}(t) \tag{2}\]  
where \(d(t)\) denotes the positioning-assisted information. The signal transmitted by the \(i\)th base station is:  
\[S^{(i)}(t)=s^{(i)}(t)\cos(2\pi f_{c}t+\varphi_{0,i}(t)) \tag{3}\]  
where \(f_{c}\) is the carrier frequency, \(\varphi_{0,i}(t)\) is the initial phase. The signal from the \(i\)th base station is received by the receiver radio frequency (RF) antenna. The output signal of the RF antenna can be written as:  
\[r(t)=\sum_{i=1}^{N}A^{(i)}s^{(i)}(t-\tau_{i})\cos(2\pi(f_{c}+f_{d,i})t+\varphi _{0,i}(t))+\omega(t) \tag{4}\]  
where \(N\) denotes the signal received from \(N\) different base stations. \(A^{(i)}\) is the signal amplitude, \(\tau_{i}\) is the incoming signal delay, \(f_{c}\) is the carrier frequency, \(f_{d,i}\) is the incoming Doppler shift, \(\varphi_{0,i}(t)\) is the initial phase, \(\omega(t)\) is the additive Gaussian white noise (AWGN) with zero mean and variance \(\sigma_{n}\)2. After the receiver RF front-end, down-conversion, low-pass filter and analog-digital conversion module (ADC), the digital intermediate frequency (IF) signal is expressed as:  
\[r_{IF}{}^{(i)}(nT_{s})=A_{IF}s^{(i)}(nT_{s}-\tau_{i})e^{2\pi(f_{IF}+f_{d,i})nT _{s}+\varphi_{0,i}}+\omega(n) \tag{5}\]  
where \(T_{s}\) is the sampling duration, \(A_{IF}\) is the IF signal amplitude, \(\tau_{i}\) is the incoming signal delay, \(f_{IF}\) is the IF frequency, \(f_{d,i}\) is the Doppler shift, \(\varphi_{0,i}\) is the initial carrier phase, \(\omega(n)\) is the additive Gaussian white noise (AWGN) with zero mean and variance \(\sigma_{n}\)2. The IF signal is sent to the baseband processor for acquisition [10], tracking and data demodulation.