method test (a:array) requires a.Length > 0 requires forall i:int :: 0<=i a[i] >= 0 ensures forall i:int :: 0<