# RankShield Energy > RankShield Energy is a nuclear reactor developer. HELIX is a sealed, transportable microreactor design, sealed sodium heat pipes with no pumps of any kind, graphite-moderated TRISO core, fully-dry cooling, passive walk-away safety, with a non-safety attestation layer, targeting the NRC's proposed 10 CFR Part 57 microreactor framework with Part 53 as the backup pathway. Pre-application stage, with the licensing program under way. Physics results are unqualified pre-QAPD screening. The reactor [Technology](https://rankshieldenergy.com/technology)[Safety](https://rankshieldenergy.com/safety)[Testing & scenarios](https://rankshieldenergy.com/testing)[Specifications](https://rankshieldenergy.com/specs)[Deployments](https://rankshieldenergy.com/deployments) [See the verification layer →](https://rankshieldenergy.com/#verify) Program [Licensing](https://rankshieldenergy.com/licensing)[Pre-application readiness](https://rankshieldenergy.com/pre-application)[Resources](https://rankshieldenergy.com/resources)[About](https://rankshieldenergy.com/about)[Verify this site](https://rankshieldenergy.com/verify) [Contact RankShield Energy →](https://rankshieldenergy.com/contact) [Contact the program →](https://rankshieldenergy.com/contact) Licensing program under way · physics results are pre-QAPD screening RankShield Energy · HELIX · Pre-application development # A microreactor engineered to be verified, not just trusted. **Firm power now takes years to buy:** interconnection queues run past half a decade and capacity prices have hit record caps. **HELIX** is the alternative, a sealed microreactor with no pumps and no water, walk-away safe by physics, set on a prepared pad in days, and engineered so an operator, insurer, or regulator can **prove** what it is doing instead of taking it on faith. [The safety case](#safety) [Licensing pathway](#licensing) Site output 4–100 MWe Modules 4.40 MWe cycle, number-up Cooling water Zero Core swap 5–7 yr cadence (target) 01, THE CONCEPT ## A sealed module. A site that arrives and connects. Power that arrives instead of waiting in an interconnection queue. Identical factory-sealed HELIX modules rated 4.40 MWe at the cycle number up from one for a hotel or campus to twenty-plus for a hyperscale site. Each module is set-and-connect on a prepared pad and cooled entirely by dry air, no cooling tower, no water draw. An N+1 reserve module carries an outage. Outbound the module is oversize and permittable at 2.70 m; whether it travels on ordinary roads or needs superload permitting turns on an envelope question we have not closed, and we say so. INSIDE HELIX ## The core is the point. Everything else gets out of its way. **RankShield is a verification company first; HELIX is the reactor built on that foundation.** A graphite-moderated TRISO core at the 19.75% HALEU ceiling, sealed sodium heat pipes with **no pumps and no water**, and fully-passive walk-away safety, built to be verified, not just trusted. Factory-built, trucked to site as an oversize load, and core-exchanged on a roughly 6 to 7 year cadence. A non-safety attestation layer lets an operator, an insurer, or a regulator independently check the module's integrity, from the factory floor to every operating hour. - 1 **Sealed domed head** & control-rod drive - 2 **RVACS** passive air shroud - 3 Sealed **reactor vessel** (low-pressure) - 4 Graphite-moderated **TRISO core** - 5 **Sodium heat pipes**, no pumps, no water - 6 Factory-sealed **swap-and-service base** Cutaway is illustrative · 2.70 m pressure-boundary diameter · core 3.00 m, overall height not yet fixed 02, THE SAFETY CASE ## Nothing in the safety case moves, and nothing is powered. Reactivity is held by strong negative-temperature feedback; sixteen control drums and a diverse shutdown rod insert fail-safe on loss of power. Decay heat is removed by natural-draft air cooling and radiation alone, and because there is no pump anywhere in the reactor, there is no loss-of-flow accident class at all, no valve, no operator action. An independent digital-safety platform provides deterministic protection; the attestation layer observes from outside this boundary and can never command it. 03, INSIDE THE CORE ## A graphite-moderated core, screened in our own physics. UCO-TRISO fuel at 19.75% HALEU in a graphite core block, ringed by sixteen B4C control drums with a diverse central shutdown rod, its heat carried out by sealed sodium heat pipes. Our continuous-energy Monte Carlo screening (unqualified, pre-QAPD) shows a strongly negative temperature coefficient, ample shutdown margin, and a reactivity-limited life of 6.67 full-power years at the current design point, bounded between 6.67 and 6.91 pending resolution of the energy-per-fission normalisation, inputs to design, not credited safety analysis. 04, THE SITE ## A power plant that arrives, connects, and runs dry. Identical sealed modules on a prepared pad, a molten-salt thermal buffer, dry sCO2 conversion skids, dry coolers, and the grid interconnection skid, the whole plant with no cooling water, no on-site nuclear work, no deep vault excavation, and sealed-core exchange on a roughly 6 to 7 year cadence. 1 5 4 3 2 6 OPERATOR FOR SCALE INSIDE HELIX ## What is actually inside the module. The whole reactor arrives sealed and never opens on site, though it is rechargeable rather than disposable: the core is exchanged at the factory, not in the field. Cut it away and there are only six things that matter, and no pump, no valve, and no drop of water among them. Tap a number on the cutaway, or a card below, to highlight the part. - 1 ### Control-rod drive & sealed head Holds a diverse shutdown rod above the core. On **any loss of power it inserts by gravity**: fail-safe, no operator, no command. - 2 ### Sodium heat pipes Sealed pipes wick heat straight out of the core. **No pumps, no valves, no water**, so there is no loss-of-flow accident class to license against. - 3 ### Graphite-moderated TRISO core UCO-TRISO fuel at the 19.75% HALEU ceiling in a graphite block. Strong negative feedback: **as it heats, it powers itself down**. - 4 ### Sealed pressure vessel A sealed pressure vessel closed at the factory and **never opened in the field**. The module trucks in, sets on a pad, and connects. - 5 ### Dry sCO₂ power take-off Heat crosses to a dry supercritical-CO₂ loop on bolt-on skids, **~40% net, air-cooled, zero cooling water**. - 6 ### Monitoring & service base Instruments every operating hour and keeps a tamper-proof record: **the same data that runs the plant efficiently** and that a lender or insurer can check. Cutaway is illustrative · 2.70 m pressure-boundary diameter · attestation features are design targets Why HELIX wins the deal ## The reactor is a commodity. Your bottom line is not. HELIX will not beat a gas turbine on sticker price per megawatt-hour, and several vendors will sell a sealed microreactor this decade. We are not trying to win that number. We are trying to win the one on your P&L: the **delivered, risk-adjusted cost of firm, clean power** over twenty years. Four things move that number, and the reactor core is not one of them. 01 · UPTIME ### More hours on line, more megawatt-hours sold Dry sCO₂ conversion at **~40% net**, plus continuous self-monitoring that flags wear **before it becomes an outage**. On a plant this size every point of capacity factor is revenue you would otherwise lose, and that monitoring is the same data the verification layer signs. 02 · COST OF CAPITAL ### Cheaper to finance. Cheaper to insure. A reactor that **continuously proves its own condition** is one a lender and an insurer can underwrite without guessing. Where capital cost dwarfs fuel cost, shaving the rate moves delivered price more than any fuel saving. That is what "verifiable" buys: **a lower rate, not a slogan**. 03 · OPERATING COST ### Runs dry, runs lean, runs unattended **No cooling water, no pumps, minimal on-site staff.** Passive walk-away safety and hands-off operation take out fixed costs a conventional plant pays every single year of its life. 04 · TIME TO POWER ### Power sooner, revenue sooner Factory-built, trucked in, set on a prepared pad, targeting the NRC's proposed **fleet-approval** microreactor path. For a buyer who is power-starved today, **months instead of years** is the whole bottom line. Security = downside Security is not a feature bolted on top; it is downside protection. One undetected tamper or a quiet degradation is the single event that strands a twenty-year asset. **The same monitoring that runs the plant efficiently is what keeps that from happening**, every hour, without anyone having to watch. Cheapest electron? No. Lowest cost to own firm, clean power you can bank on? That is the race we are running. Pre-application program · delivered-cost levers are design targets, not yet demonstrated. Design basis · targets held to an honest ceiling ## HELIX at a glance. Site output | 4.40 MWe at the cycle per sealed module; delivered at the meter is lower and site-specific. Sites number up from one module to 20+ (design target) Heat transport | 421 sealed sodium heat pipes through the core monolith; no pumps of any kind (EM-pumped pool evaluated, not selected) Fuel & core | UCO-TRISO, 19.75 wt% HALEU, graphite-moderated, inside the NRC-accepted EPRI-AR-1(NP)-A particle envelope; 1.80 m core Reflector / control | BeO reflector, 0.40 m radial; 16 B4C control drums + 1 diverse shutdown rod Cooling | Fully dry, forced-draft dry coolers; zero cooling water Power conversion | Dry sCO₂ Brayton, 40% net, air-cooled, on bolt-on skids outside the sealed module Core life | 6.67 full-power yr at the current design point, bounded 6.67–6.91 pending the energy-per-fission normalisation (screening; unqualified) Transport | 2.70 m pressure-boundary OD, oversize and permittable outbound. Road-legal is 2.60 m and costs core life; ordinary-road versus superload permitting is an open question Safety concept | Passive shutdown + natural-circulation decay-heat removal; walk-away The verification layer · non-safety, observe-only ## Each reactor proves itself. A fleet cross-checks it. This is the part we did not have to invent for the reactor: RankShield already operates a production verification network protecting live infrastructure, and HELIX inherits it. Each site signs its telemetry with post-quantum cryptography and normalizes performance against its own environment. The RankShield Network compares every reactor to what its conditions predict, so drift, whether wear or tampering, stands out against an independent-witness fleet. The layer sits outside the safety boundary behind a hardware one-way path: it can prove integrity, and by construction can never command a safety function. Provable power is easier to staff, insure, certify, and buy: the same witnessed record that shows a regulator the module is intact meters every megawatt-hour for the customer and flags efficiency drift before it costs anything. Core integrity attestation · ML-DSA-87 design-target Firmware root-of-trust · SLH-DSA / hash-based design-target Transparency log · RFC 9162-class design-target Independent off-site witness quorum design-target · recruiting Safety I&C boundary · hardware one-way path observe-only by design Fleet cross-verification · teal = attested · coral = flagged for triage Regulatory pathway ## Licensing: Part 57 primary, Part 53 backup. TARGET **10 CFR Part 57 microreactor framework (proposed May 1, 2026; final rule expected November 23, 2026)** The NRC's proposed microreactor-specific framework, providing fleet approvals of identical reactors and aimed at simple machines with simple safety systems, which the pumpless walk-away design is built to fit. Proposed, not final; we claim no approval and no application is underway. BACKUP **10 CFR Part 53 (final rule, effective April 29, 2026)** The risk-informed, technology-inclusive framework remains the backup pathway, and the scoping work done against it transfers. PLANNED **Licensing Project Plan & topical-report sequence** Phased plan scoped to a verified compliance register: licensing-basis-event selection, SSC safety classification, mechanistic source term, and Division 5 materials qualification. TRACK **DOE-authorized test unit, data credited into the commercial case** A test article under DOE authorization, with quality data collected under NQA-1 from day one, feeding the eventual NRC application, consistent with the NRC's proposed DOE-design-credit pathway. OWED **QA program (NQA-1) & PSAR** Stand up the quality-assurance program and preliminary safety analysis before any credited analysis. All physics shown to date is unqualified screening and is not carried forward as credited. The engineering · thirteen subsystems ## Engineered to the ceiling, then screened. 01 DESIGN-BASED ### Fuel & core UCO TRISO at the 19.75% HALEU ceiling in a graphite monolith, the only advanced fuel form purchasable from multiple US fabricators today. 02 DESIGN-BASED ### Sealed sodium heat transport Sealed sodium heat pipes through the core monolith delivering at 850 °C, no pumps of any kind, which is what lets the same unit serve process heat as well as electricity without redesign. An EM-pumped pool was evaluated and not selected; the decision closed on physics and install engineering, not preference. 03 DESIGN-BASED ### Reactivity & self-regulation Strong negative temperature feedback measured in screening physics; 16 B4C control drums plus one diverse shutdown rod, shutdown worth far exceeds any credible excess. 04 DESIGN-BASED ### Reflector & shielding Beryllium-oxide radial reflector, 0.40 m thick, the configuration our screening physics is run on. Thinning it from 0.50 m is what brought the module to 2.70 m; the reflector is the dominant lever on both envelope and core life, and the trade is documented rather than assumed. Layered borated shielding. 05 DESIGN-BASED ### Monolith & vessel A 50 mm vessel wall around the graphite monolith. Material selection against ASME Section III Division 5 is open and we say so: our maximum operating temperature sits near the boundary where austenitic grades give way to a nickel-base alloy, and that code case is not closed. Not 300,000 hours, comfortably beyond the module's planned service life across factory recharge cycles. 06 DESIGN-BASED ### Passive decay-heat / walk-away Decay heat leaves by natural-draft air cooling and radiation alone. Nothing powered, nothing moving, no operator action, an availability event, never a safety event. 07 DESIGN-BASED ### Power conversion Dry supercritical-CO2 Brayton conversion at 40% net, air-cooled, on bolt-on skids outside the sealed module that can be serviced or swapped without ever opening it. 08 IN EVALUATION ### Thermal energy storage A molten-salt buffer lets modules run flat at their sweet spot while stored heat follows demand swings and bridges transients, the reactor never chases load. 09 DESIGN-BASED ### Dry heat rejection Forced-draft dry coolers, variable-speed fans. No water, no cooling tower, no draw against the community that hosts it. 10 DESIGN-BASED ### Site architecture Number-up identical 4.40 MWe modules, one for a campus, twenty-plus for a hyperscale site, with N+1 reserve. Sealed in the field and never opened on site, but not disposable: at end of core life the module is exchanged and its core returns to the factory to be defueled and recharged. The site runs indefinitely on rolling exchange. The honest gap is the return leg, where the irradiated core ships in a Type B cask that is not yet licensed. 11 DESIGN-BASED ### Grid integration Five reference integration archetypes spanning every US facility class, with a pre-engineered adaptive skid and the IEEE 1547 protocol envelope built in. 12 DESIGN-BASED ### I&C, autonomy & digital twin FPGA deterministic safety on an NRC-approved platform lineage, plus an attested digital twin behind a one-way data diode. 13 DESIGN-BASED ### Post-quantum attestation ML-DSA-87 telemetry and SLH-DSA hash-based firmware signing anchored to a witnessed transparency log, from factory floor through transport to every operating hour. The machine · photoreal cutaway ## The whole reactor, in a single sealed view. Cut the module open and there is no pump, no valve, and no drop of water. Sodium heat pipes wick heat straight off a graphite-moderated **TRISO core** to a dry power loop, the shutdown rod sits above the core and drops by gravity on any loss of power, and the vessel is closed at the factory and **never opened in the field**. The operator is there for scale. Core height 3.00 m Diameter 2.70 m Output 4.40 MWe cycle Cutaway is illustrative · 2.70 m is the pressure-boundary diameter; the shipped envelope adds a casing stack we have not yet fixed. Honest status · what is done, what is owed ## Gates before any hardware. DONE **Design of record & adversarial verification** Reactor and integration design consolidated; hundreds of sourced claims adversarially verified; competitive and materials landscape assessed. DONE **Reactor-physics screening (unqualified)** Continuous-energy Monte Carlo screening of criticality, lifetime, reactivity feedback, shutdown worth, and post-trip xenon. Screening inputs to design; pre-QAPD; not credited. IN PROGRESS **Scenario & failure campaign** Nominal, harsh-environment, chaotic-failure, production, grid/EMC, and long-run internal scenarios; structural/thermal FEA stand-up owed for cascade and stress cases. OWED **Independent physics validation** Qualified-lane confirmation with independent codes and, ultimately, test data. No claim of validated performance is made. OWED **NRC licensing & validated demand** An NRC application, under Part 57 once the rule is final or under Part 53 as the backup, and confirmed offtake demand are prerequisites to any hardware commitment. Ask the founder ## Every question, answered directly. The questions a regulator, a partner, or an engineer asks about HELIX, answered by the founder. No forms, no sales pitch. **Jamie Kloncz** Founder · RankShield Energy ** ONLINE - 01 What exactly is RankShield Energy building? - 02 Is this an operating reactor? - 03 Why should a regulator or partner take a pre-application program seriously? - 04 How does HELIX make power without water? - 05 What fuel does it use, and can you actually buy it? - 06 How big is a site and how often do you swap the core? - 07 What happens in a total loss of power and cooling? - 08 Can the verification network ever interfere with safety? - 09 What does "verifiable" actually mean here? - 10 How does a fleet catch a problem before it becomes one? - 11 What is the licensing pathway? - 12 What still has to happen before you build hardware? *Pick a question on the left, or search above, and you'll get the direct answer, the way an answer engine would give it.* ← Prev Next → - / 12 [Talk to the founder →](https://rankshieldenergy.com/contact) What exactly is RankShield Energy building? We are developing HELIX, our own sealed, transportable microreactor, targeting the NRC's proposed 10 CFR Part 57 microreactor framework with Part 53 as the backup pathway, with a qualified third-party fabricator manufacturing to our specification. What makes us different is not the reactor. It is that ours can be independently verified. Every module signs its telemetry and is attested from the factory floor to every operating hour. Is this an operating reactor? Not yet. It is pre-application development, not an operating product. No microreactor of this class has been built or run at its rated life yet, including ours. Every figure we publish is a design target and every physics result is unqualified screening, pre-QAPD. We label all of it honestly. That discipline is what makes the rest credible. Why should a regulator or partner take a pre-application program seriously? Because pre-application is exactly where the credible advanced-reactor cohort is. Part 53 only became final in 2026, the microreactor-specific Part 57 is still a proposed rule, and the leading microreactor developers are all in pre-application or early licensing. We treat the honest labels as milestones on a defined path we are actively executing, not as caveats. How does HELIX make power without water? Heat leaves the core through sealed sodium heat pipes, no pumps of any kind and no water anywhere in the primary. A dry supercritical-CO2 Brayton cycle on skids outside the sealed module converts it to electricity, targeting roughly 40 percent net. All heat is rejected to dry coolers, so there is no cooling tower and no water draw against the community that hosts the plant. What fuel does it use, and can you actually buy it? UCO-TRISO at 19.75 percent HALEU in a graphite core. It is the only advanced fuel form that is both NRC-precedented and purchasable from multiple US fabricators today. Our screening also shows the core reaches its reactivity limit with most of its uranium unburned, over 90 percent of the U-235 remains, so factory recharge re-banks that reactivity rather than discarding a nearly full fuel load. How big is a site and how often do you swap the core? A site numbers up identical sealed modules of roughly 5 megawatts each, one for a hotel or campus, twenty-plus for a hyperscale site. Staggered sealed-core swaps land on a roughly 5 to 7 year cadence and an N+1 reserve module carries an outage, so the modules are multi-year but the site runs indefinitely on rolling factory recharge. Our depletion screening puts module life at roughly four to five full-power years as modeled, likely five to seven once known model conservatisms are removed. What happens in a total loss of power and cooling? Nothing that matters. Reactivity self-limits on a strongly negative temperature coefficient, the control drums insert fail-safe by spring and gravity with no power needed, and decay heat leaves by natural-draft air cooling and radiation alone. A total loss of power and cooling is an availability event, not a safety event. There are no pumps anywhere in the reactor, so there is no loss-of-flow accident class, and the safety case never credits a pump, a valve, an operator, or a network. Can the verification network ever interfere with safety? No, by construction of the wiring. The attestation layer is classified non-safety and observe-only. It sits behind a hardware one-way path, so it can prove a module is intact but it physically cannot send a command toward a safety system. The safety systems are local and passive and unreachable from any network. What does "verifiable" actually mean here? Each module signs its sensor readings and firmware with post-quantum cryptography and anchors them to an append-only log co-signed by independent off-site witnesses. An operator, an insurer, or a regulator can check a module directly rather than take our word for it. Anyone can write the word secure. Only a verifiable reactor lets you check. How does a fleet catch a problem before it becomes one? Each site normalizes its performance against its own environment, then the RankShield Network compares every reactor to what its conditions predict. A reactor that drifts from that expectation stands out against an independent-witness fleet. The elegant part is that the same signal flags both wear and tampering, so one detector serves efficiency and security. What is the licensing pathway? Our primary target is 10 CFR Part 57, the NRC's proposed microreactor framework (proposed May 1, 2026; final rule expected November 23, 2026). It provides fleet approvals of identical reactors and is aimed at simple machines with simple safety systems, which the pumpless walk-away design is built to fit. Part 53, final since April 2026, remains the backup pathway and our scoping work against it transfers. We claim no approval, and no application is underway. What still has to happen before you build hardware? A stood-up NQA-1 quality program, independent physics validation with independent codes and ultimately test data, an NRC license, under Part 57 once the rule is final or under Part 53 as the backup, and validated demand. All of it is defined and stated on our licensing page. We make no economic, schedule, or performance guarantee, only honest labeled progress.