The reactor · design of record

How the HELIX microreactor works.

HELIX is a sealed, transportable microreactor built around choices we can defend on physics, supply chain, and licensing, not on novelty. It uses a graphite-moderated core of UCO-TRISO fuel at 19.75% HALEU, moves heat with low-pressure sodium, rejects that heat to dry air with zero cooling water, and shuts itself down on its own physics. This page walks the reactor from the fuel kernel outward, and states plainly why each subsystem was chosen and where it still has to be proven.

Most advanced-reactor concepts try to win on a single exotic idea. We took the opposite discipline. Every HELIX subsystem was pushed to its honest engineering ceiling, screened in our own reactor-physics simulations, and then checked against one hard filter: can the materials actually be bought, and can the design actually be licensed. Where a more glamorous choice failed that filter, we took the buildable one. What follows is the result of that filtering, subsystem by subsystem.

What is the HELIX core made of?

The core is a nuclear-graphite monolith drilled with channels that hold UCO-TRISO fuel compacts. The fuel is uranium oxycarbide enriched to 19.75%, which is high-assay low-enriched uranium (HALEU), the highest enrichment allowed below the 20% line that triggers a different security category. TRISO stands for tri-structural isotropic: each microscopic fuel kernel is wrapped in layers of carbon and silicon carbide that form an individual pressure vessel around it. A single fuel compact contains thousands of these kernels, and the silicon-carbide layer retains fission products to temperatures far above anything the reactor reaches in normal operation or in a loss-of-cooling event.

This is the single most important materials choice in the design. TRISO is not a laboratory curiosity; it is the fuel form the US Department of Energy has invested in for a decade, it has NRC licensing precedent, and it is purchasable today from more than one qualified American fabricator. Choosing it means the fuel supply is a procurement question, not a research program. It also means the first and most robust barrier against a radiological release is built into the fuel itself, before any engineered system is credited.

How does HELIX control the reaction?

Reactivity is held by sixteen boron-carbide control drums arranged around the core and one diverse central shutdown rod. A control drum is a cylinder with a neutron absorber on one face; rotating it toward or away from the core raises or lowers reactivity smoothly, with no fast-moving parts inside the pressure boundary. The drums fail safe: on any loss of power they rotate their absorbing face inward under spring return, driving the core subcritical without a generator, an operator, or a line of software.

Underneath that engineered control sits the physics that actually keeps the reactor stable. HELIX is designed for a strongly negative temperature coefficient of reactivity, screened in the range of roughly negative six to negative eight pcm per kelvin. In plain terms: if the core heats up, the reaction naturally slows down. Power and temperature are self-limiting before any control system has to act. Our screening shows the combined worth of the drums and the diverse rod exceeds any credible excess reactivity with margin to spare, and the core stays subcritical even if the single most effective drum is assumed stuck. Those are screening results, unqualified and pre-QAPD, and they are inputs to the design rather than credited safety analysis, but they are the reason the control system is a backstop to the physics, not the other way around.

How does heat leave the core?

Heat leaves the core through low-pressure liquid sodium at roughly 650 degrees Celsius, with no water anywhere in the primary system. Sodium is an excellent heat-transfer fluid at near-atmospheric pressure, which is the whole point: because the coolant is not pressurized, there is no stored pressure energy waiting to drive a blowdown, and there is no loss-of-coolant accident of the kind that dominates light-water-reactor safety analysis. The same property lets decay heat move by natural circulation after a shutdown, with nothing powered and nothing pumped.

One decision on this page is still genuinely open, and we will not pretend otherwise. Two heat-transport architectures are in final evaluation: sealed sodium heat pipes, which have no moving parts and no pumping at all, versus an electromagnetically-pumped sodium pool, which uses a pump with no moving mechanical parts (an EM field moves the liquid metal directly). Both keep decay-heat removal fully passive. The choice between them is being made on screening physics and demonstrated engineering, not on preference. What matters for safety is the invariant that holds either way: the reactor runs dry, and the safety case never credits a pump. Whatever moves heat during normal operation, shutdown cooling is carried by natural circulation alone.

Why did HELIX drop beryllium for graphite?

Early microreactor reflector designs, ours included, reached for beryllium or beryllium oxide because they are superb neutron reflectors that shrink the core. We walked away from them, and the reasoning is worth stating because it is the clearest example of our design discipline. Beryllium is toxic, effectively single-source, and heavy, and in our own screening its mass drove the transportable module over its weight budget as the sealed life got longer. A reflector built from nuclear graphite with a thin alumina outer layer is multi-supplier, non-exotic, and far lighter. It costs some neutron economy, which we bought back elsewhere in the core, and it keeps the module both transportable and free of a supply chain we do not control. We would rather spend neutrons than depend on a material we cannot reliably buy.

The pressure vessel and core internals are 316H stainless steel, chosen because it is code-qualified under ASME Section III Division 5 in the high-temperature creep regime the reactor operates in, with coverage well beyond the intended design life. This is another availability choice: 316H is a known, code-covered material with a deep supplier base, not a bespoke alloy that needs its own qualification campaign.

How is the electricity actually made, and where does the waste heat go?

Heat from the sodium loop crosses an intermediate heat exchanger and drives an air-cooled organic Rankine cycle for the first units. An ORC is the only power-conversion technology proven to run unattended at this power scale, and choosing it means there is no steam plant on site and therefore no energetic sodium-water interface to engineer around. A supercritical-CO2 conversion path is funded as an efficiency upgrade for later units, but it is a roadmap item, not a claim about the first build. Critically, the conversion island sits outside the sealed reactor module and can be serviced or upgraded without ever opening the module.

All of the reactor's waste heat is rejected to forced-draft dry coolers with variable-speed fans. There is no cooling tower and no evaporative water loss, which means zero cooling-water draw against whatever community or facility hosts the plant. For a microreactor meant to sit beside a data center, an industrial site, or a town, removing the water fight is not a minor convenience; it removes one of the most reliable reasons a thermal plant gets blocked in local permitting.

How does a HELIX site fit together?

A molten-salt thermal buffer sits between the reactor and the load. It lets each module run flat at its most efficient operating point while stored heat follows demand swings and bridges short transients. The reactor never chases load; the buffer does. A full site runs two to four factory-sealed modules for a combined 10 to 16 MWe net, operated at 76 to 95 percent of rating so that staggered core swaps land on an 8 to 10 year cadence and the site's reserve margin can carry a single module through an outage. The entire plant, reactor modules, thermal buffer, conversion island, dry coolers, and grid-interconnection skid, arrives on trucks, connects on a prepared pad, and runs.

What is proven, and what is still owed?

Everything above is a design of record supported by our own continuous-energy Monte Carlo screening in OpenMC with ENDF/B-VII.1 cross-sections. That screening is unqualified and produced outside a nuclear quality-assurance program, so it informs design decisions and is never credited in a safety case. The qualified path is defined and honestly owed: a stood-up NQA-1 quality program, independent physics validation with independent codes and ultimately test data, licensing under 10 CFR Part 53, and validated demand before any hardware is committed. We publish the targets and label the screening as screening because a reactor whose whole promise is that you can check it cannot afford to blur the line between what is designed and what is proven.

See the full specification and dimensioned engineering drawings →

Read how the safety case works →