In order to identify the fault causes from rapid evaluating on alarms of protection and breaker actions in substation， a four-layered cause-effect rule-reasoning-network for various substation components is built according to power grid and substation structure， and protection principles. The layered cause-effect rule-network includes layers such as: fault source， candidate fault cause， protection action and breaker tripping. The cause-effect relations among different layers are constructed. Different triggering probabilities are given to various candidate causes of a fault source respectively. One reaching path for a fault candidate cause is divided into two sections， namely， from candidate cause to protection action， and from protection action to breaker tripping. And different contribution rates of certainty factor in the two sections are set. When a fault occurs， the average method is adopted to compute the integrated certainty factor based on certainty factors of various reaching paths of a candidate cause. The fault component as well as its cause can be found by sorting and evaluating the certainty factors of suspected fault sources. The proposed evaluation method needs little calculation labor， and can rapidly find fault component and cause with high certainty factor in practical substation.