Abstract: The process layer network of intelligent substations carries SV sampling, GOOSE tripping, and PTP timing services. Equipment defects often spread continuously along physical links, layer 2 forwarding, and service subscription links, and single point alarms are difficult to restore the true fault path. The paper proposes a maintenance and troubleshooting method for business risk boundaries, incorporating impact domain modeling, univariate perturbation, pressure replay, time-series evidence graph, and closed-loop acceptance into a unified process. The method starts with configuring baselines, message baselines, and link baselines, uses multi-source time alignment to form a fault evidence chain, and then relies on causal paths to complete hierarchical positioning and root cause confidence verification. This framework can compress the scope of invalid tests, preserve on-site evidence of faults, strengthen maintenance permission control and retest traceability, and provide executable paths for process layer network state maintenance, defect management, and cycle optimization.