The reactor · design of record

How the HELIX microreactor works.

HELIX is a sealed, transportable microreactor built around choices we can defend on physics, supply chain, and licensing, not on novelty. It uses a graphite-moderated core of UCO-TRISO fuel at 19.75% HALEU, moves heat with sealed sodium heat pipes and no pumps of any kind, rejects that heat to dry air with zero cooling water, and shuts itself down on its own physics. This page walks the reactor from the fuel kernel outward, and states plainly why each subsystem was chosen and where it still has to be proven.

Most advanced-reactor concepts try to win on a single exotic idea. We took the opposite discipline. Every HELIX subsystem was pushed to its honest engineering ceiling, screened in our own reactor-physics simulations, and then checked against one hard filter: can the materials actually be bought, and can the design actually be licensed. Where a more glamorous choice failed that filter, we took the buildable one. What follows is the result of that filtering, subsystem by subsystem.

What is the HELIX core made of?

The core is a nuclear-graphite monolith drilled with channels that hold UCO-TRISO fuel compacts. The fuel is uranium oxycarbide enriched to 19.75%, which is high-assay low-enriched uranium (HALEU), the highest enrichment allowed below the 20% line that triggers a different security category. TRISO stands for tri-structural isotropic: each microscopic fuel kernel is wrapped in layers of carbon and silicon carbide that form an individual pressure vessel around it. A single fuel compact contains thousands of these kernels, and the silicon-carbide layer retains fission products to temperatures far above anything the reactor reaches in normal operation or in a loss-of-cooling event.

This is the single most important materials choice in the design. TRISO is not a laboratory curiosity; it is the fuel form the US Department of Energy has invested in for a decade, it has NRC licensing precedent, and it is purchasable today from more than one qualified American fabricator. Choosing it means the fuel supply is a procurement question, not a research program. It also means the first and most robust barrier against a radiological release is built into the fuel itself, before any engineered system is credited.

How does HELIX control the reaction?

Reactivity is held by sixteen boron-carbide control drums arranged around the core and one diverse central shutdown rod. A control drum is a cylinder with a neutron absorber on one face; rotating it toward or away from the core raises or lowers reactivity smoothly, with no fast-moving parts inside the pressure boundary. The drums fail safe: on any loss of power they rotate their absorbing face inward under spring return, driving the core subcritical without a generator, an operator, or a line of software.

Underneath that engineered control sits the physics that actually keeps the reactor stable. HELIX is designed for a strongly negative temperature coefficient of reactivity, screened in the range of roughly negative six to negative eight pcm per kelvin. In plain terms: if the core heats up, the reaction naturally slows down. Power and temperature are self-limiting before any control system has to act. Our screening shows the combined worth of the drums and the diverse rod exceeds any credible excess reactivity with margin to spare, and the core stays subcritical even if the single most effective drum is assumed stuck. Those are screening results, unqualified and pre-QAPD, and they are inputs to the design rather than credited safety analysis, but they are the reason the control system is a backstop to the physics, not the other way around.

How does heat leave the core?

Heat leaves the core through sealed sodium heat pipes run through the graphite monolith, carrying it at roughly 650 degrees Celsius with no water anywhere in the primary system. Sodium is an excellent heat-transfer fluid at near-atmospheric pressure, which is the whole point: because the working fluid is not pressurized, there is no stored pressure energy waiting to drive a blowdown, and there is no loss-of-coolant accident of the kind that dominates light-water-reactor safety analysis. After a shutdown, decay heat leaves by natural-draft air cooling and radiation, with nothing powered and nothing pumped.

This decision was, until recently, genuinely open on this page, and we will state plainly how it closed. Two heat-transport architectures went through final evaluation: sealed sodium heat pipes, which have no moving parts and no pumping at all, versus an electromagnetically-pumped sodium pool, which uses a pump with no moving mechanical parts. The heat pipes won, and they won on physics and install engineering, not on preference: the pumped pool lost on installed weight, on commissioning complexity, and on the value of having zero pumps of any kind. The safety invariant is now simpler than the one we used to defend. There is no pump anywhere in the reactor, so there is no loss-of-flow accident class, and the safety case never credits a pump for the plainest possible reason: none exists. Shutdown cooling is carried by natural-draft air cooling and radiation alone.

Why does HELIX carry a beryllium-oxide reflector?

The core is ringed by a beryllium-oxide radial reflector, 0.40 m thick, and this is the one materials choice where we accepted a constrained supply chain because the physics demanded it. BeO is a superb neutron reflector, and in a core small enough to travel on a truck, that reflection is what makes a multi-year sealed life reachable at all: every screening result we publish, criticality, shutdown worth, and lifetime, is computed with this reflector in place. We state the costs as plainly as the benefit. Beryllium oxide is toxic to machine, expensive, and supply-limited, and the module's BeO inventory is a flagged cost item in our own engineering register. A split reflector, BeO on the inner band with nuclear graphite on the outer band, is under study to cut that inventory without giving back the neutron economy, and if it screens well it will be adopted through the same labeled process as every other change to the design basis.

The pressure vessel is a 50 mm wall around the graphite monolith, and we have not yet fixed its material. We are explicit about why that matters rather than quietly naming an alloy: the maximum operating temperature in our design basis sits near the boundary where code-qualified austenitic grades give way to a nickel-base alloy under ASME Section III Division 5, and the vessel's own operating temperature is not yet a recorded quantity in that basis. Until it is, the Division 5 code case cannot honestly be called closed. Regulatory Guide 1.87 governs that acceptance, and resolving it is a named item on our licensing path rather than an assumption buried in a spec table. The preference is a known, code-covered material with a deep supplier base over a bespoke alloy that would need its own qualification campaign, but preference is not qualification and we do not present it as one.

How is the electricity actually made, and where does the waste heat go?

Heat from the heat pipes crosses an intermediate heat exchanger and drives a dry supercritical-CO2 Brayton cycle, air-cooled and targeting roughly 40 percent net conversion, so a module at 11.0 MWth delivers 4.40 MWe net. Choosing a dry cycle means there is no steam plant on site and therefore no energetic sodium-water interface to engineer around. Critically, the conversion machinery rides on bolt-on skids outside the sealed reactor module and can be serviced or upgraded without ever opening the module.

All of the reactor's waste heat is rejected to forced-draft dry coolers with variable-speed fans. There is no cooling tower and no evaporative water loss, which means zero cooling-water draw against whatever community or facility hosts the plant. For a microreactor meant to sit beside a data center, an industrial site, or a town, removing the water fight is not a minor convenience; it removes one of the most reliable reasons a thermal plant gets blocked in local permitting.

How does a HELIX site fit together?

A molten-salt thermal buffer sits between the reactor and the load. It lets each module run flat at its most efficient operating point while stored heat follows demand swings and bridges short transients. The reactor never chases load; the buffer does. A site numbers up identical factory-sealed modules rated 4.40 MWe at the cycle, one module for a hotel or a campus, twenty-plus for a hyperscale site, held to an N+1 reserve margin so a single module outage never takes the site down. Delivered output per module is lower and site-specific; the configurator computes it. Sealed does not mean single-use. The module is sealed in the field and never opened on site, but core exchange lands on a roughly 6 to 7 year cadence and each swapped core returns to the factory to be defueled, recharged and refurbished, so the modules are multi-year while the site runs indefinitely on rolling factory recharge. We are explicit about the unfinished part of that: the irradiated core ships in a Type B cask rather than the whole module, that package is not yet licensed, and at an estimated 72 tonnes it is a superload rather than a routine move. Outbound, the fresh module at 2.70 m is oversize and permittable; road-legal is 2.60 m and costs core life, and which of those a unit needs is a question our envelope work has not closed.

What is proven, and what is still owed?

Everything above is a design of record supported by our own continuous-energy Monte Carlo screening in OpenMC with ENDF/B-VII.1 cross-sections. That screening is unqualified and produced outside a nuclear quality-assurance program, so it informs design decisions and is never credited in a safety case. The qualified path is defined and honestly owed: a stood-up NQA-1 quality program, independent physics validation with independent codes and ultimately test data, NRC licensing, under the proposed 10 CFR Part 57 microreactor framework once it is final, with Part 53 as the backup, and validated demand before any hardware is committed. We publish the targets and label the screening as screening because a reactor whose whole promise is that you can check it cannot afford to blur the line between what is designed and what is proven.

See the full specification and dimensioned engineering drawings →

Read how the safety case works →