Site output
10–16 MWe
RankShield Energy · HELIX · Part 53 development
A microreactor engineered to be verified, not just trusted.
RankShield Energy is developing HELIX, our own sealed, transportable microreactor: low-pressure sodium heat transport, a graphite-moderated TRISO core, fully-dry cooling, and passive walk-away safety, paired with a non-safety attestation layer that lets an operator, an insurer, or a regulator independently check the module's integrity.
The core is screened in our own reactor-physics simulations, the licensing pathway is elected under NRC 10 CFR Part 53, and the integration and attestation methods are filed. We publish honest targets and label every result, this is a program executing a defined path, not a promise.
01, THE CONCEPT
A sealed module. A site that arrives and connects.
Two to four factory-sealed HELIX modules per site produce 10–16 MWe. Each module is transportable, set-and-connect, and cooled entirely by dry air, no cooling tower, no water draw. Modules run at 76–95% of rating so staggered core swaps land on an 8–10 year cadence and reserve margin carries a module outage.
02, THE SAFETY CASE
Nothing in the safety case moves, and nothing is powered.
Reactivity is held by strong negative-temperature feedback; sixteen control drums and a diverse shutdown rod insert fail-safe on loss of power. Decay heat is removed by natural circulation and radiation alone, no pump, no valve, no operator action. An independent digital-safety platform provides deterministic protection; the attestation layer observes from outside this boundary and can never command it.
03, INSIDE THE CORE
A graphite-moderated core, screened in our own physics.
UCO-TRISO fuel at 19.75% HALEU in a graphite core block, ringed by sixteen B4C control drums with a diverse central shutdown rod, cooled by low-pressure sodium. Our continuous-energy Monte Carlo screening (unqualified, pre-QAPD) shows a strongly negative temperature coefficient, ample shutdown margin, and a reactivity-limited life consistent with the 8–10 year swap target at fleet rating, inputs to design, not credited safety analysis.
04, THE SITE
A power plant that arrives, connects, and runs dry.
Two to four sealed modules in hardened vaults, a molten-salt thermal buffer, an air-cooled conversion island, dry coolers, and the grid interconnection skid, the whole plant on one pad with no cooling water and staggered core swaps every 8–10 years.
Design basis · targets held to an honest ceiling
HELIX at a glance.
| Site output | 10–16 MWe net from 2–4 sealed modules (design target) |
| Heat transport | Low-pressure sodium; EM-pumped pool architecture in evaluation against a heat-pipe variant |
| Fuel & core | UCO-TRISO, 19.75% HALEU, graphite-moderated; 316H vessel (ASME III Div 5) |
| Reflector / control | Graphite reflector; 16 B4C control drums + 1 diverse shutdown rod |
| Cooling | Fully dry, forced-draft dry coolers; zero cooling water |
| Power conversion | Air-cooled ORC (first-of-a-kind); sCO₂ as a funded upgrade path |
| Core life | 8–10 yr swap target at 76–95% fleet rating (screening; unqualified) |
| Safety concept | Passive shutdown + natural-circulation decay-heat removal; walk-away |
The verification layer · non-safety, observe-only
Each reactor proves itself. A fleet cross-checks it.
Each site signs its telemetry with post-quantum cryptography and normalizes performance against its own environment. The RankShield Network compares every reactor to what its conditions predict, so drift, whether wear or tampering, stands out against an independent-witness fleet. The layer sits outside the safety boundary behind a hardware one-way path: it can prove integrity, and by construction can never command a safety function.
Core integrity attestation · ML-DSA-65design-target
Firmware root-of-trust · LMS / hash-baseddesign-target
Transparency log · RFC 9162-classdesign-target
Independent off-site witness quorumdesign-target · recruiting
Safety I&C boundary · hardware one-way pathobserve-only by design
Fleet cross-verification · teal = attested · coral = flagged for triage
Regulatory pathway
Licensing under 10 CFR Part 53.
ELECTED
10 CFR Part 53 (final rule, effective April 29, 2026)
Risk-informed, technology-inclusive framework elected as the primary licensing pathway. Pre-application engagement is the current phase.
PLANNED
Licensing Project Plan & topical-report sequence
Phased plan scoped to a verified compliance register: licensing-basis-event selection, SSC safety classification, mechanistic source term, and Division 5 materials qualification.
TRACK
DOE-authorized test unit, data credited into the commercial case
A test article under DOE authorization, with quality data collected under NQA-1 from day one, feeding the Part 53 application, consistent with the NRC's proposed DOE-design-credit pathway.
OWED
QA program (NQA-1) & PSAR
Stand up the quality-assurance program and preliminary safety analysis before any credited analysis. All physics shown to date is unqualified screening and is not carried forward as credited.
The engineering · thirteen subsystems
Engineered to the ceiling, then screened.
01 DESIGN-BASED
Fuel & core
UCO TRISO at the 19.75% HALEU ceiling in a graphite monolith, the only advanced fuel form purchasable from three US fabricators today.
02 IN EVALUATION
Sealed sodium heat transport
Low-pressure sodium at ~650°C. Two architectures in final evaluation, sealed heat pipes vs an EM-pumped pool with no moving parts, decided by physics, not preference.
03 DESIGN-BASED
Reactivity & self-regulation
Strong negative temperature feedback measured in screening physics; 16 B4C control drums plus one diverse shutdown rod, shutdown worth far exceeds any credible excess.
04 DESIGN-BASED
Reflector & shielding
Graphite reflector with a thin alumina outer layer, multi-supplier, no exotic inputs. Layered borated shielding; no supply-constrained materials anywhere.
05 DESIGN-BASED
Monolith & vessel
316H vessel in the code-qualified creep regime, ASME-covered to 300,000 hours, double our design life.
06 DESIGN-BASED
Passive decay-heat / walk-away
Decay heat leaves by natural circulation and radiation alone. Nothing powered, nothing moving, no operator action, an availability event, never a safety event.
07 DESIGN-BASED
Power conversion
Air-cooled ORC first, the only proven unattended option at this scale, with a funded sCO2 upgrade path. The conversion island sits outside the sealed module and swaps without touching it.
08 IN EVALUATION
Thermal energy storage
A molten-salt buffer lets modules run flat at their sweet spot while stored heat follows demand swings and bridges transients, the reactor never chases load.
09 DESIGN-BASED
Dry heat rejection
Forced-draft dry coolers, variable-speed fans. No water, no cooling tower, no draw against the community that hosts it.
10 DESIGN-BASED
Site architecture
2–4 sealed modules per site, 10–16 MWe, run at 76–95% rating so staggered core swaps land every 8–10 years and reserve margin carries a module outage.
11 DESIGN-BASED
Grid integration
Five reference integration archetypes spanning every US facility class, with a pre-engineered adaptive skid and the IEEE 1547 protocol envelope built in.
12 DESIGN-BASED
I&C, autonomy & digital twin
FPGA deterministic safety on an NRC-approved platform lineage, plus an attested digital twin behind a one-way data diode.
13 DESIGN-BASED
Post-quantum attestation
ML-DSA-65 telemetry and hash-based firmware signing anchored to a witnessed transparency log, from factory floor through transport to every operating hour.
Honest status · what is done, what is owed
Gates before any hardware.
DONE
Design of record & adversarial verification
Reactor and integration design consolidated; hundreds of sourced claims adversarially verified; competitive and materials landscape assessed.
DONE
Reactor-physics screening (unqualified)
Continuous-energy Monte Carlo screening of criticality, lifetime, reactivity feedback, shutdown worth, and post-trip xenon. Screening inputs to design; pre-QAPD; not credited.
IN PROGRESS
Scenario & failure campaign
Nominal, harsh-environment, chaotic-failure, production, grid/EMC, and long-run internal scenarios; structural/thermal FEA stand-up owed for cascade and stress cases.
OWED
Independent physics validation
Qualified-lane confirmation with independent codes and, ultimately, test data. No claim of validated performance is made.
OWED
NRC licensing & validated demand
Part 53 application and confirmed offtake demand are prerequisites to any hardware commitment.
Ask the founder
Every question, answered directly.
The questions a regulator, a partner, or an engineer asks about HELIX, answered by the founder. No forms, no sales pitch.
✓ Ask me anything about HELIX, the safety case, verification, or the Part 53 pathway. Tap a question to start.
- What exactly is RankShield Energy building?
- We are developing HELIX, our own sealed, transportable microreactor, and licensing it under 10 CFR Part 53 with a qualified third-party fabricator manufacturing to our specification. What makes us different is not the reactor. It is that ours can be independently verified. Every module signs its telemetry and is attested from the factory floor to every operating hour.
- Is this an operating reactor, or a study?
- It is pre-application development, not an operating product. No microreactor of this class has been built or run at its rated life yet, including ours. Every figure we publish is a design target and every physics result is unqualified screening, pre-QAPD. We label all of it honestly. That discipline is what makes the rest credible.
- Why should a regulator or partner take a pre-application program seriously?
- Because pre-application is exactly where the credible advanced-reactor cohort is. Part 53 only became final in 2026, and the leading microreactor developers are all in pre-application or early licensing. We treat the honest labels as milestones on a defined path we are actively executing, not as caveats.
- How does HELIX make power without water?
- Heat leaves the core through low-pressure sodium with no water anywhere in the primary. An air-cooled organic Rankine cycle converts it to electricity for the first units, with a funded supercritical-CO2 upgrade path later. All heat is rejected to dry coolers, so there is no cooling tower and no water draw against the community that hosts the plant.
- What fuel does it use, and can you actually buy it?
- UCO-TRISO at 19.75 percent HALEU in a graphite core. It is the only advanced fuel form that is both NRC-precedented and purchasable from multiple US fabricators today. We also designed a multi-batch factory recharge that reuses partially burned fuel, which cuts how much fresh HALEU each swap needs by roughly three times.
- How big is a site and how often do you swap the core?
- Two to four sealed modules per site produce 10 to 16 megawatts of electricity. We run each module at 76 to 95 percent of rating so staggered core swaps land on an 8 to 10 year cadence, and reserve margin carries a module outage. Our own depletion screening supports that lifetime target.
- What happens in a total loss of power and cooling?
- Nothing that matters. Reactivity self-limits on a strongly negative temperature coefficient, the control drums insert fail-safe by spring and gravity with no power needed, and decay heat leaves by natural circulation alone. A total loss of power and cooling is an availability event, not a safety event. The safety case never credits a pump, a valve, an operator, or a network.
- Can the verification network ever interfere with safety?
- No, by construction of the wiring. The attestation layer is classified non-safety and observe-only. It sits behind a hardware one-way path, so it can prove a module is intact but it physically cannot send a command toward a safety system. The safety systems are local and passive and unreachable from any network.
- What does "verifiable" actually mean here?
- Each module signs its sensor readings and firmware with post-quantum cryptography and anchors them to an append-only log co-signed by independent off-site witnesses. An operator, an insurer, or a regulator can check a module directly rather than take our word for it. Anyone can write the word secure. Only a verifiable reactor lets you check.
- How does a fleet catch a problem before it becomes one?
- Each site normalizes its performance against its own environment, then the RankShield Network compares every reactor to what its conditions predict. A reactor that drifts from that expectation stands out against an independent-witness fleet. The elegant part is that the same signal flags both wear and tampering, so one detector serves efficiency and security.
- What is the licensing pathway?
- We elected 10 CFR Part 53, the risk-informed framework that went final in April 2026. We scoped the topical-report sequence to a verified compliance register and are structuring a DOE-authorized test unit so its data, collected under NQA-1 from day one, credits into the commercial case.
- What still has to happen before you build hardware?
- A stood-up NQA-1 quality program, independent physics validation with independent codes and ultimately test data, an NRC license under Part 53, and validated demand. All of it is defined and stated on our licensing page. We make no economic, schedule, or performance guarantee, only honest labeled progress.