As in normal LTE, NPSS is also using a Zad-off Chu signal. I put the NPSS(LTE-NB) generation formula and PSS(LTE) formula toghether for comparision. As I mentioned, they are both Zadoff Chu form, but slight difference in denominator and NPSS has another term labeled S(l).
Followings are the topics to be covered in this page.
- How does the NPSS sequence differ from the LTE PSS ?
- How is NPSS mapped to resource elements ?
- Reference
How does the NPSS sequence differ from the LTE PSS ?
Both signals start from a Zadoff-Chu sequence, so the useful comparison is in the details: the sequence length, the number of roots and the extra S(l) term. The picture below puts 36.211 clause 10.2.7.1 for NPSS above clause 6.11.1 for the LTE PSS.

NPSS is a length-11 Zadoff-Chu sequence sent in 11 OFDM symbols with a sign cover code S(l). LTE PSS is one length-63 sequence without its centre element, sent in a single symbol.
Look at the denominators first. NPSS divides by 11 and uses n = 0 to 10, so each OFDM symbol carries 11 elements. LTE PSS divides by 63 and uses n = 0 to 61, which fills 62 subcarriers around DC in one symbol.
The S(l) term is the new part. 36.211 Table 10.2.7.1.1-1 gives it for symbols 3 to 13 as 1, 1, 1, 1, -1, -1, 1, 1, 1, -1, 1. So the same 11-element sequence is sent in 11 symbols, and S(l) flips the sign of three of them. The cover code makes the 11 repetitions differ from one another, which helps the UE find the symbol timing inside the subframe.
The number of roots differs as well. LTE uses three PSS roots, one for each value of NID(2), so the PSS already carries part of the cell ID. The NPSS formula has a single root u, so every NB-IoT cell sends the same NPSS. The UE therefore learns nothing about the cell ID from NPSS, and the whole ID comes from NSSS.
11 elements per symbol, 11 symbols per subframe : NPSS spreads one short sequence over time instead of over frequency.S(l) is a sign cover code : three of the 11 symbols, 7, 8 and 12, are sent with the sign flipped.One root for every cell : NPSS gives timing and frequency, not cell identity.LTE PSS needs three roots : each root marks one value of NID(2).
How is NPSS mapped to resource elements ?
The biggest difference between PSS and NPSS lies with resource allocation (RE mapping). In LTE, you can have 6 RB width (72 resource elements) in single OFDM symbol to accommodate a long sequence made of 62 symbols, but in LTE-NB you have only one RB width (12 resource elements) in on OFDM symbol. So you can accommodate only a small number of data in single OFDM symbol. With such a small number of data, it would be difficult to achieve a good correlation required for NPSS detection. So, they use multiple OFDM symbols (11 OFDM Symbols) to accomodate the sync signal which is long enough to achieve good correlation. Basically, a whole RB is used to carry the NPSS. Also, the subframe that carries the NPSS is a little different comparing to LTE case.

NPSS sits in subframe 5 of every radio frame and fills subcarriers 0 to 10 of symbols 3 to 13. LTE CRS resource elements puncture it, and subcarrier 11 stays unused.
Every radio frame, subframe 5 : the frame row at the top shows NPSS in subframe 5 of every frame, and NSSS in subframe 9 of every second frame.11 subcarriers, 11 symbols : k runs from 0 to 10 and l from 3 to 13, which matches the 11 elements and the 11 values of S(l).The first three symbols stay free : symbols 0 to 2 are left for the LTE PDCCH, or unused.LTE CRS takes priority : the red resource elements inside the blue block are LTE CRS, and NPSS gives way to them.
36.211 v19.3.0 clause 10.2.7.1.2 states the CRS rule precisely. Where a resource element overlaps an LTE CRS, the NPSS element for it is not sent, but it is still counted in the mapping. So the sequence does not shift around the CRS. The UE simply loses those elements.
The same clause limits what the UE may assume about the antenna port. The UE shall not assume that NPSS uses the same antenna port as any downlink reference signal. It also shall not assume that NPSS in one subframe uses the same antenna port as NPSS in another subframe. So the UE cannot use NPSS as a channel estimate for other signals, and it should not rely on combining NPSS coherently across radio frames.
Reference
[1] 3GPP TS 36.211 v19.3.0 - clause 6.11.1 for the LTE PSS, clause 10.2.7.1 for NPSS sequence generation and mapping