Site output
4–100 MWe
Licensing program under way · physics results are pre-QAPD screening
RankShield Energy · HELIX · Pre-application development
A microreactor engineered to be verified, not just trusted.
Firm power now takes years to buy: interconnection queues run past half a decade and capacity prices have hit record caps. HELIX is the alternative, a sealed microreactor with no pumps and no water, walk-away safe by physics, set on a prepared pad in days, and engineered so an operator, insurer, or regulator can prove what it is doing instead of taking it on faith.
01, THE CONCEPT
A sealed module. A site that arrives and connects.
Power that arrives instead of waiting in an interconnection queue. Identical factory-sealed HELIX modules rated 4.40 MWe at the cycle number up from one for a hotel or campus to twenty-plus for a hyperscale site. Each module is set-and-connect on a prepared pad and cooled entirely by dry air, no cooling tower, no water draw. An N+1 reserve module carries an outage. Outbound the module is oversize and permittable at 2.70 m; whether it travels on ordinary roads or needs superload permitting turns on an envelope question we have not closed, and we say so.
INSIDE HELIX
The core is the point. Everything else gets out of its way.
RankShield is a verification company first; HELIX is the reactor built on that foundation. A graphite-moderated TRISO core at the 19.75% HALEU ceiling, sealed sodium heat pipes with no pumps and no water, and fully-passive walk-away safety, built to be verified, not just trusted.
Factory-built, trucked to site as an oversize load, and core-exchanged on a roughly 6 to 7 year cadence. A non-safety attestation layer lets an operator, an insurer, or a regulator independently check the module's integrity, from the factory floor to every operating hour.
- 1Sealed domed head & control-rod drive
- 2RVACS passive air shroud
- 3Sealed reactor vessel (low-pressure)
- 4Graphite-moderated TRISO core
- 5Sodium heat pipes, no pumps, no water
- 6Factory-sealed swap-and-service base
Cutaway is illustrative · 2.70 m pressure-boundary diameter · core 3.00 m, overall height not yet fixed
02, THE SAFETY CASE
Nothing in the safety case moves, and nothing is powered.
Reactivity is held by strong negative-temperature feedback; sixteen control drums and a diverse shutdown rod insert fail-safe on loss of power. Decay heat is removed by natural-draft air cooling and radiation alone, and because there is no pump anywhere in the reactor, there is no loss-of-flow accident class at all, no valve, no operator action. An independent digital-safety platform provides deterministic protection; the attestation layer observes from outside this boundary and can never command it.
03, INSIDE THE CORE
A graphite-moderated core, screened in our own physics.
UCO-TRISO fuel at 19.75% HALEU in a graphite core block, ringed by sixteen B4C control drums with a diverse central shutdown rod, its heat carried out by sealed sodium heat pipes. Our continuous-energy Monte Carlo screening (unqualified, pre-QAPD) shows a strongly negative temperature coefficient, ample shutdown margin, and a reactivity-limited life of 6.67 full-power years at the current design point, bounded between 6.67 and 6.91 pending resolution of the energy-per-fission normalisation, inputs to design, not credited safety analysis.
04, THE SITE
A power plant that arrives, connects, and runs dry.
Identical sealed modules on a prepared pad, a molten-salt thermal buffer, dry sCO2 conversion skids, dry coolers, and the grid interconnection skid, the whole plant with no cooling water, no on-site nuclear work, no deep vault excavation, and sealed-core exchange on a roughly 6 to 7 year cadence.
1 5 4 3 2 6 OPERATORFOR SCALE
INSIDE HELIX
What is actually inside the module.
The whole reactor arrives sealed and never opens on site, though it is rechargeable rather than disposable: the core is exchanged at the factory, not in the field. Cut it away and there are only six things that matter, and no pump, no valve, and no drop of water among them.
Tap a number on the cutaway, or a card below, to highlight the part.
- 1
Control-rod drive & sealed head
Holds a diverse shutdown rod above the core. On any loss of power it inserts by gravity: fail-safe, no operator, no command.
- 2
Sodium heat pipes
Sealed pipes wick heat straight out of the core. No pumps, no valves, no water, so there is no loss-of-flow accident class to license against.
- 3
Graphite-moderated TRISO core
UCO-TRISO fuel at the 19.75% HALEU ceiling in a graphite block. Strong negative feedback: as it heats, it powers itself down.
- 4
Sealed pressure vessel
A sealed pressure vessel closed at the factory and never opened in the field. The module trucks in, sets on a pad, and connects.
- 5
Dry sCO₂ power take-off
Heat crosses to a dry supercritical-CO₂ loop on bolt-on skids, ~40% net, air-cooled, zero cooling water.
- 6
Monitoring & service base
Instruments every operating hour and keeps a tamper-proof record: the same data that runs the plant efficiently and that a lender or insurer can check.
Cutaway is illustrative · 2.70 m pressure-boundary diameter · attestation features are design targets
Why HELIX wins the deal
The reactor is a commodity. Your bottom line is not.
HELIX will not beat a gas turbine on sticker price per megawatt-hour, and several vendors will sell a sealed microreactor this decade. We are not trying to win that number. We are trying to win the one on your P&L: the delivered, risk-adjusted cost of firm, clean power over twenty years. Four things move that number, and the reactor core is not one of them.
01 · UPTIME
More hours on line, more megawatt-hours sold
Dry sCO₂ conversion at ~40% net, plus continuous self-monitoring that flags wear before it becomes an outage. On a plant this size every point of capacity factor is revenue you would otherwise lose, and that monitoring is the same data the verification layer signs.
02 · COST OF CAPITAL
Cheaper to finance. Cheaper to insure.
A reactor that continuously proves its own condition is one a lender and an insurer can underwrite without guessing. Where capital cost dwarfs fuel cost, shaving the rate moves delivered price more than any fuel saving. That is what "verifiable" buys: a lower rate, not a slogan.
03 · OPERATING COST
Runs dry, runs lean, runs unattended
No cooling water, no pumps, minimal on-site staff. Passive walk-away safety and hands-off operation take out fixed costs a conventional plant pays every single year of its life.
04 · TIME TO POWER
Power sooner, revenue sooner
Factory-built, trucked in, set on a prepared pad, targeting the NRC's proposed fleet-approval microreactor path. For a buyer who is power-starved today, months instead of years is the whole bottom line.
Security =
downside
downside
Security is not a feature bolted on top; it is downside protection. One undetected tamper or a quiet degradation is the single event that strands a twenty-year asset. The same monitoring that runs the plant efficiently is what keeps that from happening, every hour, without anyone having to watch.
Cheapest electron? No. Lowest cost to own firm, clean power you can bank on? That is the race we are running.
Pre-application program · delivered-cost levers are design targets, not yet demonstrated.
Design basis · targets held to an honest ceiling
HELIX at a glance.
| Site output | 4.40 MWe at the cycle per sealed module; delivered at the meter is lower and site-specific. Sites number up from one module to 20+ (design target) |
| Heat transport | 421 sealed sodium heat pipes through the core monolith; no pumps of any kind (EM-pumped pool evaluated, not selected) |
| Fuel & core | UCO-TRISO, 19.75 wt% HALEU, graphite-moderated, inside the NRC-accepted EPRI-AR-1(NP)-A particle envelope; 1.80 m core |
| Reflector / control | BeO reflector, 0.40 m radial; 16 B4C control drums + 1 diverse shutdown rod |
| Cooling | Fully dry, forced-draft dry coolers; zero cooling water |
| Power conversion | Dry sCO₂ Brayton, 40% net, air-cooled, on bolt-on skids outside the sealed module |
| Core life | 6.67 full-power yr at the current design point, bounded 6.67–6.91 pending the energy-per-fission normalisation (screening; unqualified) |
| Transport | 2.70 m pressure-boundary OD, oversize and permittable outbound. Road-legal is 2.60 m and costs core life; ordinary-road versus superload permitting is an open question |
| Safety concept | Passive shutdown + natural-circulation decay-heat removal; walk-away |
The verification layer · non-safety, observe-only
Each reactor proves itself. A fleet cross-checks it.
This is the part we did not have to invent for the reactor: RankShield already operates a production verification network protecting live infrastructure, and HELIX inherits it. Each site signs its telemetry with post-quantum cryptography and normalizes performance against its own environment. The RankShield Network compares every reactor to what its conditions predict, so drift, whether wear or tampering, stands out against an independent-witness fleet. The layer sits outside the safety boundary behind a hardware one-way path: it can prove integrity, and by construction can never command a safety function. Provable power is easier to staff, insure, certify, and buy: the same witnessed record that shows a regulator the module is intact meters every megawatt-hour for the customer and flags efficiency drift before it costs anything.
Core integrity attestation · ML-DSA-87design-target
Firmware root-of-trust · SLH-DSA / hash-baseddesign-target
Transparency log · RFC 9162-classdesign-target
Independent off-site witness quorumdesign-target · recruiting
Safety I&C boundary · hardware one-way pathobserve-only by design
Fleet cross-verification · teal = attested · coral = flagged for triage
Regulatory pathway
Licensing: Part 57 primary, Part 53 backup.
TARGET
10 CFR Part 57 microreactor framework (proposed May 1, 2026; final rule expected November 23, 2026)
The NRC's proposed microreactor-specific framework, providing fleet approvals of identical reactors and aimed at simple machines with simple safety systems, which the pumpless walk-away design is built to fit. Proposed, not final; we claim no approval and no application is underway.
BACKUP
10 CFR Part 53 (final rule, effective April 29, 2026)
The risk-informed, technology-inclusive framework remains the backup pathway, and the scoping work done against it transfers.
PLANNED
Licensing Project Plan & topical-report sequence
Phased plan scoped to a verified compliance register: licensing-basis-event selection, SSC safety classification, mechanistic source term, and Division 5 materials qualification.
TRACK
DOE-authorized test unit, data credited into the commercial case
A test article under DOE authorization, with quality data collected under NQA-1 from day one, feeding the eventual NRC application, consistent with the NRC's proposed DOE-design-credit pathway.
OWED
QA program (NQA-1) & PSAR
Stand up the quality-assurance program and preliminary safety analysis before any credited analysis. All physics shown to date is unqualified screening and is not carried forward as credited.
The engineering · thirteen subsystems
Engineered to the ceiling, then screened.
01 DESIGN-BASED
Fuel & core
UCO TRISO at the 19.75% HALEU ceiling in a graphite monolith, the only advanced fuel form purchasable from multiple US fabricators today.
02 DESIGN-BASED
Sealed sodium heat transport
Sealed sodium heat pipes through the core monolith delivering at 850 °C, no pumps of any kind, which is what lets the same unit serve process heat as well as electricity without redesign. An EM-pumped pool was evaluated and not selected; the decision closed on physics and install engineering, not preference.
03 DESIGN-BASED
Reactivity & self-regulation
Strong negative temperature feedback measured in screening physics; 16 B4C control drums plus one diverse shutdown rod, shutdown worth far exceeds any credible excess.
04 DESIGN-BASED
Reflector & shielding
Beryllium-oxide radial reflector, 0.40 m thick, the configuration our screening physics is run on. Thinning it from 0.50 m is what brought the module to 2.70 m; the reflector is the dominant lever on both envelope and core life, and the trade is documented rather than assumed. Layered borated shielding.
05 DESIGN-BASED
Monolith & vessel
A 50 mm vessel wall around the graphite monolith. Material selection against ASME Section III Division 5 is open and we say so: our maximum operating temperature sits near the boundary where austenitic grades give way to a nickel-base alloy, and that code case is not closed. Not 300,000 hours, comfortably beyond the module's planned service life across factory recharge cycles.
06 DESIGN-BASED
Passive decay-heat / walk-away
Decay heat leaves by natural-draft air cooling and radiation alone. Nothing powered, nothing moving, no operator action, an availability event, never a safety event.
07 DESIGN-BASED
Power conversion
Dry supercritical-CO2 Brayton conversion at 40% net, air-cooled, on bolt-on skids outside the sealed module that can be serviced or swapped without ever opening it.
08 IN EVALUATION
Thermal energy storage
A molten-salt buffer lets modules run flat at their sweet spot while stored heat follows demand swings and bridges transients, the reactor never chases load.
09 DESIGN-BASED
Dry heat rejection
Forced-draft dry coolers, variable-speed fans. No water, no cooling tower, no draw against the community that hosts it.
10 DESIGN-BASED
Site architecture
Number-up identical 4.40 MWe modules, one for a campus, twenty-plus for a hyperscale site, with N+1 reserve. Sealed in the field and never opened on site, but not disposable: at end of core life the module is exchanged and its core returns to the factory to be defueled and recharged. The site runs indefinitely on rolling exchange. The honest gap is the return leg, where the irradiated core ships in a Type B cask that is not yet licensed.
11 DESIGN-BASED
Grid integration
Five reference integration archetypes spanning every US facility class, with a pre-engineered adaptive skid and the IEEE 1547 protocol envelope built in.
12 DESIGN-BASED
I&C, autonomy & digital twin
FPGA deterministic safety on an NRC-approved platform lineage, plus an attested digital twin behind a one-way data diode.
13 DESIGN-BASED
Post-quantum attestation
ML-DSA-87 telemetry and SLH-DSA hash-based firmware signing anchored to a witnessed transparency log, from factory floor through transport to every operating hour.
The machine · photoreal cutaway
The whole reactor, in a single sealed view.
Cut the module open and there is no pump, no valve, and no drop of water. Sodium heat pipes wick heat straight off a graphite-moderated TRISO core to a dry power loop, the shutdown rod sits above the core and drops by gravity on any loss of power, and the vessel is closed at the factory and never opened in the field. The operator is there for scale.
Core height
3.00 m
Diameter
2.70 m
Output
4.40 MWe cycle
Cutaway is illustrative · 2.70 m is the pressure-boundary diameter; the shipped envelope adds a casing stack we have not yet fixed.
Honest status · what is done, what is owed
Gates before any hardware.
DONE
Design of record & adversarial verification
Reactor and integration design consolidated; hundreds of sourced claims adversarially verified; competitive and materials landscape assessed.
DONE
Reactor-physics screening (unqualified)
Continuous-energy Monte Carlo screening of criticality, lifetime, reactivity feedback, shutdown worth, and post-trip xenon. Screening inputs to design; pre-QAPD; not credited.
IN PROGRESS
Scenario & failure campaign
Nominal, harsh-environment, chaotic-failure, production, grid/EMC, and long-run internal scenarios; structural/thermal FEA stand-up owed for cascade and stress cases.
OWED
Independent physics validation
Qualified-lane confirmation with independent codes and, ultimately, test data. No claim of validated performance is made.
OWED
NRC licensing & validated demand
An NRC application, under Part 57 once the rule is final or under Part 53 as the backup, and confirmed offtake demand are prerequisites to any hardware commitment.
Ask the founder
Every question, answered directly.
The questions a regulator, a partner, or an engineer asks about HELIX, answered by the founder. No forms, no sales pitch.
ONLINE
Pick a question on the left, or search above, and you'll get the direct answer, the way an answer engine would give it.
- / 12
Talk to the founder → - What exactly is RankShield Energy building?
- We are developing HELIX, our own sealed, transportable microreactor, targeting the NRC's proposed 10 CFR Part 57 microreactor framework with Part 53 as the backup pathway, with a qualified third-party fabricator manufacturing to our specification. What makes us different is not the reactor. It is that ours can be independently verified. Every module signs its telemetry and is attested from the factory floor to every operating hour.
- Is this an operating reactor?
- Not yet. It is pre-application development, not an operating product. No microreactor of this class has been built or run at its rated life yet, including ours. Every figure we publish is a design target and every physics result is unqualified screening, pre-QAPD. We label all of it honestly. That discipline is what makes the rest credible.
- Why should a regulator or partner take a pre-application program seriously?
- Because pre-application is exactly where the credible advanced-reactor cohort is. Part 53 only became final in 2026, the microreactor-specific Part 57 is still a proposed rule, and the leading microreactor developers are all in pre-application or early licensing. We treat the honest labels as milestones on a defined path we are actively executing, not as caveats.
- How does HELIX make power without water?
- Heat leaves the core through sealed sodium heat pipes, no pumps of any kind and no water anywhere in the primary. A dry supercritical-CO2 Brayton cycle on skids outside the sealed module converts it to electricity, targeting roughly 40 percent net. All heat is rejected to dry coolers, so there is no cooling tower and no water draw against the community that hosts the plant.
- What fuel does it use, and can you actually buy it?
- UCO-TRISO at 19.75 percent HALEU in a graphite core. It is the only advanced fuel form that is both NRC-precedented and purchasable from multiple US fabricators today. Our screening also shows the core reaches its reactivity limit with most of its uranium unburned, over 90 percent of the U-235 remains, so factory recharge re-banks that reactivity rather than discarding a nearly full fuel load.
- How big is a site and how often do you swap the core?
- A site numbers up identical sealed modules of roughly 5 megawatts each, one for a hotel or campus, twenty-plus for a hyperscale site. Staggered sealed-core swaps land on a roughly 5 to 7 year cadence and an N+1 reserve module carries an outage, so the modules are multi-year but the site runs indefinitely on rolling factory recharge. Our depletion screening puts module life at roughly four to five full-power years as modeled, likely five to seven once known model conservatisms are removed.
- What happens in a total loss of power and cooling?
- Nothing that matters. Reactivity self-limits on a strongly negative temperature coefficient, the control drums insert fail-safe by spring and gravity with no power needed, and decay heat leaves by natural-draft air cooling and radiation alone. A total loss of power and cooling is an availability event, not a safety event. There are no pumps anywhere in the reactor, so there is no loss-of-flow accident class, and the safety case never credits a pump, a valve, an operator, or a network.
- Can the verification network ever interfere with safety?
- No, by construction of the wiring. The attestation layer is classified non-safety and observe-only. It sits behind a hardware one-way path, so it can prove a module is intact but it physically cannot send a command toward a safety system. The safety systems are local and passive and unreachable from any network.
- What does "verifiable" actually mean here?
- Each module signs its sensor readings and firmware with post-quantum cryptography and anchors them to an append-only log co-signed by independent off-site witnesses. An operator, an insurer, or a regulator can check a module directly rather than take our word for it. Anyone can write the word secure. Only a verifiable reactor lets you check.
- How does a fleet catch a problem before it becomes one?
- Each site normalizes its performance against its own environment, then the RankShield Network compares every reactor to what its conditions predict. A reactor that drifts from that expectation stands out against an independent-witness fleet. The elegant part is that the same signal flags both wear and tampering, so one detector serves efficiency and security.
- What is the licensing pathway?
- Our primary target is 10 CFR Part 57, the NRC's proposed microreactor framework (proposed May 1, 2026; final rule expected November 23, 2026). It provides fleet approvals of identical reactors and is aimed at simple machines with simple safety systems, which the pumpless walk-away design is built to fit. Part 53, final since April 2026, remains the backup pathway and our scoping work against it transfers. We claim no approval, and no application is underway.
- What still has to happen before you build hardware?
- A stood-up NQA-1 quality program, independent physics validation with independent codes and ultimately test data, an NRC license, under Part 57 once the rule is final or under Part 53 as the backup, and validated demand. All of it is defined and stated on our licensing page. We make no economic, schedule, or performance guarantee, only honest labeled progress.