I&#x27;ve actually been building a teaching VM with these properties. You can&#x27;t take the address of arbitrary values (so there&#x27;s no distinction between lvalues and rvalues), there&#x27;s no pointer arithmetic (instead you have type-safe primitives for record access and array indexing), all arrays (including strings) know their length and bounds-check accesses, and unions behave more like sum types, always knowing precisely what type they have stored. All these constraints ensure you can never convert a number to an address, or generate an address to an illegal value. More info about the goal and rationale: <a href="http:&#x2F;&#x2F;akkartik.name&#x2F;post&#x2F;mu;" rel="nofollow">http:&#x2F;&#x2F;akkartik.name&#x2F;post&#x2F;mu;</a> <a href="http:&#x2F;&#x2F;github.com&#x2F;akkartik&#x2F;mu" rel="nofollow">http:&#x2F;&#x2F;github.com&#x2F;akkartik&#x2F;mu</a>.<p>I also recently found out about <a href="http:&#x2F;&#x2F;eigenstate.org&#x2F;myrddin" rel="nofollow">http:&#x2F;&#x2F;eigenstate.org&#x2F;myrddin</a> which seems more mature with <i>very</i> similar goals&#x2F;aesthetics. I&#x27;ve been digging into it a fair bit.<p>Finally, on the extreme other end of the spectrum, there&#x27;s Rust.