## 4 Signal Models  
NB-IoT is designed to operate in half-duplex Frequency-Division Duplexing (FDD) mode with normal CP. The frequency domain data \(S_{p,f}^{(m)}(k)\) carried by the \(k\)th subcarrier of NB-IoT is symmetrically distributed on the 200 KHz bandwidth with a 10 KHz guard band in each side and the central frequency point is unused to avoid any problems caused by direct current (DC). After conducting IFFT and adding normal CP, the time domain NB-IoT radio frame samples \(s_{p,f}^{(m)}(n)\) are obtained. \(p\in[0,P]\) is the subframe index within radio frame \(r_{f}\). \(m\in[0,M]\) represents the OFDM symbol index in one subframe, and \(n\in[1,N+N_{g}]\) denotes the sample index in a OFDM symbol. Here, \(N\) is the IFFT size and \(N_{g}\) is the length of normal CP. Besides, there are relationships of \(P=9\) and \(M=13\) in the NB-IoT system. Then, the signals transmitted from the base station are propagated by the multi-path fading channel of Extended Typical Urban (ETU) or Extended Pedestrian A (EPA), and the route mean square delay spread (RMS-DS) and coherence bandwidth of ETU and EPA are 991 ns and 45 ns, and 1.01 MHz and 22.2 MHz, respectively. The radio signals are received by the NB-IoT radio frequency receiver which down converts the radio signals to the baseband. After that, the in-phase and quadrature vectors of analog baseband signals are quantified by ADCs. Considering the additive white Gaussian noise (AWGN), ETU or EPA multi-path channels and the CFO introduced by oscillators in the transmitter and receiver, the samples of the received signals can be expressed as follows:  
\[r_{p,f}^{(m)}(n)=e^{j2\pi\frac{(n+m(N+N_{g}))(j_{E}+\epsilon_{I})}{N}}\sum_{l =0}^{L-1}h(l)s_{p,f}^{(m)}(l-n)+\omega(n), \tag{3}\]  
where \(h(l)\) is the channel impulse response of the \(l\)th frequency selective fading channel, and \(L\) is the taps of the fading channel. \(\epsilon_{F}\) represents the FFO, and the IFO part is denoted by \(\epsilon_{I}\). \(\omega\) is the zero mean AWGN introduced by the communication link with variance of \(\sigma_{\omega}^{2}\). In the working scenarios of NB-IoT, the maximum frequency offset range may achieve [\(-25.5\) KHz, \(25.5\) KHz] [29]. The received NPSS symbols are maintained identical by the following relationship:  
\[c(0)r_{5,f}^{(3)}(n)=c(1)r_{5,f}^{(4)}(n)=\cdots=c(M-3)r_{5,f}^{(M)}(n). \tag{4}\]  
Traditionally, the time domain symbol synchronization with identical preambles is accomplished with an autocorrelation timing metric (TM) which consists of an autocorrelation part and a normalization factor. The following equation indicates the basic implementation [10]. \[\gamma(\tau)=\frac{\alpha(\tau)}{\beta(\tau)}. \tag{5}\]  
with  
\[\alpha(\tau)=\left|\sum_{n=1}^{N}\sum_{m=3}^{M-1}c(m-3)r_{p,f}^{(m)}(n)c(m-2)r_ {p,f}^{(m+1)*}(n)\right|^{2}. \tag{6}\]  
\[\beta(\tau)=\sum_{n=1}^{N}\sum_{m=3}^{M}\left|r_{p,f}^{(m)}(n)\right|^{2}. \tag{7}\]where \(\tau\) represents the start time of the detection window, and \((\cdot)^{*}\) is complex conjugation. However, when in the context of low SNR, the conventional normalization factor (NF) in Equation (7) will be invalid. So, an effective NF is urgently needed to improve the performance of the NPSS detector. In the process of cell ID identification, the detection of NSSS from numerous sequences runs counter to the concept of low complexity design of NB-IoT terminals. Furthermore, for the reason that the coherent algorithms for SSS detection are inapplicable for NSSS, a suitable correlation detection method is urgently needed. Another significant feature of NB-IoT is that a 40 ms UTG should be inserted into the uplink transmission once the frequency offset exceeds the predefined threshold [2], and the specific implementation is shown in Figure 3.  
During UTG, the system converts to downlink transmission to estimate and compensate the residual frequency offset (RFO) [30, 31], and the initial cell search and coarse synchronization are considered to have been accomplished.