diff --git a/ql-application/threadx/interface/custom_app/mqtt.c b/ql-application/threadx/interface/custom_app/mqtt.c
index 0d9da6b..9b61cc0 100644
--- a/ql-application/threadx/interface/custom_app/mqtt.c
+++ b/ql-application/threadx/interface/custom_app/mqtt.c
@@ -391,11 +391,12 @@ int parse_event_response(const char *json_str, response_t *resp)
 
 
 /* [FIX] 安全处理 topic 名称，避免越界访问 */
-static void messageArrived(MessageData* data)
-{
-    int ret;
-    uint32 queue_count = 0;
-    app_work_item *work_item;
+static void messageArrived(MessageData* data)
+{
+    int ret;
+    int payload_log_len;
+    uint32 queue_count = 0;
+    app_work_item *work_item;
 
     // 安全获取 topic 字符串（复制到本地缓冲区）
     char topic_buf[128] = {0};
@@ -403,10 +404,16 @@ static void messageArrived(MessageData* data)
     if (topic_len >= sizeof(topic_buf)) {
         topic_len = sizeof(topic_buf) - 1;
     }
-    memcpy(topic_buf, data->topicName->lenstring.data, topic_len);
-    topic_buf[topic_len] = '\0';
-
-    // 比较 topic 类型
+    memcpy(topic_buf, data->topicName->lenstring.data, topic_len);
+    topic_buf[topic_len] = '\0';
+
+    payload_log_len = data->message->payloadlen > 512 ? 512 : (int)data->message->payloadlen;
+    printf("[MQTT-RX] topic=%s len=%d payload=%.*s%s\r\n",
+           topic_buf, (int)data->message->payloadlen, payload_log_len,
+           (const char *)data->message->payload,
+           data->message->payloadlen > (unsigned int)payload_log_len ? "..." : "");
+
+    // 比较 topic 类型
     int is_command = (strstr(topic_buf, "command") != NULL);
     int is_event_resp = (strstr(topic_buf, "event_resp") != NULL) || (strstr(topic_buf, imei_buf) != NULL);
 
@@ -618,15 +625,33 @@ sub_exit:
 //0:代表respone command     
 //1:代表send event
 /* [FIX] 将连接状态检查和发送放在同一锁保护区内，避免竞争 */
-int app_mqtt_publish(char *buf, int len, int type)
-{
-	static uint32_t mqtt_pub_cnt_err=0;
-	int rc = -1;
-	MQTTMessage message;
-	int cnt = 0;
-	static uint8_t publish_error = 0;
-
-	// 锁保护：检查连接状态并发送
+int app_mqtt_publish(char *buf, int len, int type)
+{
+    static uint32_t mqtt_pub_cnt_err=0;
+    int rc = -1;
+    int payload_log_len;
+    MQTTMessage message;
+    int cnt = 0;
+    static uint8_t publish_error = 0;
+    const char *publish_topic = NULL;
+
+    if (type == 0) {
+        publish_topic = respone_topicName;
+    } else if (type == 1) {
+        publish_topic = event_topicName;
+    } else if (type == 2) {
+        publish_topic = event_register;
+    } else {
+        RLOGE("invalid MQTT publish type=%d", type);
+        return -1;
+    }
+
+    payload_log_len = len > 512 ? 512 : len;
+    printf("[MQTT-TX] topic=%s len=%d payload=%.*s%s\r\n",
+           publish_topic, len, payload_log_len, buf,
+           len > payload_log_len ? "..." : "");
+
+    // 锁保护：检查连接状态并发送
 	int lock_ret = ql_rtos_mutex_lock(g_mqtt_public_mutex, 5000);
 	if (lock_ret != 0) {
 		RLOGE("MQTT mutex lock timeout");
@@ -643,18 +668,13 @@ int app_mqtt_publish(char *buf, int len, int type)
 	message.payload = buf;
 	message.payloadlen = len;
 
-	while (cnt++ < 3) {
-		u32 start = ql_rtos_get_systicks();
-		if (type == 0) {
-			rc = MQTTPublish(&client, respone_topicName, &message);
-		} else if (type == 1) {
-			rc = MQTTPublish(&client, event_topicName, &message);
-		} else if (type == 2) {
-			rc = MQTTPublish(&client, event_register, &message);
-		}
-
-		RLOGD("Pulish time:%d len: %d\n", (ql_rtos_get_systicks()-start)*5, len);
-		if (rc != 0) {
+    while (cnt++ < 3) {
+        u32 start = ql_rtos_get_systicks();
+        rc = MQTTPublish(&client, publish_topic, &message);
+
+        RLOGD("Pulish time:%d len: %d\n", (ql_rtos_get_systicks()-start)*5, len);
+        printf("[MQTT-TX] topic=%s attempt=%d rc=%d\r\n", publish_topic, cnt, rc);
+        if (rc != 0) {
 			mqtt_pub_cnt_err++;
 			mqtt_public_error = 1;
 			RLOGE("ERROR Return code from MQTT publish is %d, cnt %d", rc, mqtt_pub_cnt_err);
@@ -1250,23 +1270,34 @@ void handle_nfc_trigger(const char *uuid)
     free(json_str);
 }
 
-void handle_nfc_bind(const char *uuid)
-{
-    cJSON *root = cJSON_CreateObject();
-	cJSON *data = cJSON_CreateObject();
-    
-    cJSON_AddStringToObject(root, "msg_id", "006");
-    cJSON_AddStringToObject(root, "status", "success");
-
-	cJSON_AddStringToObject(data, "uuid", uuid);
-	cJSON_AddItemToObject(root, "data", data);
-    
-    char *json_str = cJSON_PrintUnformatted(root);
-    cJSON_Delete(root);
-		
-    app_mqtt_publish(json_str, strlen(json_str), 0);
-    free(json_str);
-}
+void handle_nfc_bind(const char *uuid)
+{
+	char iccid[QL_SIM_ICCID_LEN * 2 + 1] = {0};
+	QL_SIM_ERROR_CODE sim_ret;
+	cJSON *root = cJSON_CreateObject();
+	cJSON *data = cJSON_CreateObject();
+
+	cJSON_AddStringToObject(root, "msg_id", "006");
+	cJSON_AddStringToObject(root, "status", "success");
+
+	cJSON_AddStringToObject(data, "uuid", uuid);
+
+	sim_ret = ql_sim_get_iccid(iccid, sizeof(iccid));
+	if (sim_ret == QL_SIM_SUCCESS && iccid[0] != '\0') {
+		printf("NFC bind ICCID:%s\r\n", iccid);
+		cJSON_AddStringToObject(data, "iccid", iccid);
+	} else {
+		printf("NFC bind get ICCID failed, ret:%d\r\n", sim_ret);
+	}
+
+	cJSON_AddItemToObject(root, "data", data);
+
+	char *json_str = cJSON_PrintUnformatted(root);
+	cJSON_Delete(root);
+
+	app_mqtt_publish(json_str, strlen(json_str), 0);
+	free(json_str);
+}