In the existing substations, when the fault occurs, too many alarm signals will be sent to the substation layer, so that the monitoring personnel cannot find the critical fault information in time. In order to solve this problem, this paper proposes a fault diagnosis method using analyzed alarm signals in substation layer. Firstly, use the string matching algorithm to extract the information of alarm signals and establish signal model and then form the signal information table. Secondly, put the analyzed signals of "accident" and "change-position" level into the device fault causal logic models to determine the failure equipment of the substation. At the same time, if the protection and the circuit breaker incorrect action occur, the inference rules are used to make a preliminary judgment on the cause of the incorrect operation. Finally form a fault brief in substation layer which can assist the monitoring personnel to find faulty equipment and the cause of fault quickly.