NASA officials said Thursday that they are starting from scratch in figuring out how to keep the space shuttle's external fuel tank from shedding dangerous chunks of foam, opening an investigation that could keep the human spaceflight program grounded for a long time.

Wayne Hale, deputy manager of the space shuttle program, presented new images of the shuttle Discovery's Tuesday launch that showed that a small piece of foam may have hit the orbiter's wing. It was traveling too slowly to cause damage, but with a weight of about a 10th of a pound, it was still unacceptably large by NASA's new standards.

Of far more serious concern was a foam fragment weighing 0.9 pounds that spun harmlessly into the sky about two minutes into Discovery's launch. NASA engineers called it a hazard with the potential to destroy the orbiter and ordered an immediate shutdown of future shuttle flights until the cause of the debris shedding can be found and fixed.

John Shannon, shuttle flight operations and integration manager, said the space agency has "nothing on the shelf" to immediately fix a problem whose cause remains unresolved. He said that "everything is on the table" as about 200 analysts pored over photographs and data from the launch.

Discovery apparently emerged unscathed, however, and it docked flawlessly Thursday morning with the international space station, allowing mission commander Eileen Collins and six other astronauts to join station commander Sergei Krikalev and flight engineer John Phillips for eight days of joint operations.

On the ground, by contrast, NASA was left trying to explain a debris incident eerily reminiscent of the catastrophe that doomed the space shuttle Columbia, whose heat shielding was fatally breached by a foam fragment during launch.

Columbia disintegrated during reentry Feb. 1, 2003, grounding the shuttle fleet for 21/2 years while NASA worked to solve the debris problem. Discovery, hailed as the opening act of the shuttle's long-awaited return to flight, has instead begun to look like the only mission that will fly for some time.

NASA officials have thus far declined to formally postpone a flight scheduled for the next launch window, in September, but Hale said Discovery would transfer extra water, food and two laptop computers to help the space station survive what could be another prolonged lapse before the next shuttle visit. Without the shuttles, the space station must rely for supplies on Russian spacecraft that have only a small fraction of the cargo capacity.

For a reeling NASA, hoping to embrace President Bush's initiative to return humans to the moon and eventually send them on to Mars, the latest grounding came as a devastating blow.

Bush's "Vision for Space Exploration" calls for NASA to retire the shuttle in 2010 after completing construction of the space station, a goal that some saw as unrealistic before the Discovery flight and quite likely impossible if the shuttle fleet must stand down for a long time.

For an agency that put its reputation on the line to fix problems with the external tank's foam insulation after the Columbia disaster, Tuesday's incident put a humiliating finish to 21/2 years of redesigns and testing.

Hale said he had sent an e-mail to the Discovery crew members Wednesday, telling them: "I was absolutely mortified at the performance of the external tank foam, and we were not going to fly again until we fix it."

A congressional source, who was not authorized to speak on the record, said that "short of killing people, this is about the worst thing that could have happened" to the shuttle, and that NASA Administrator Michael D. Griffin would probably find "a lot more support now" on Capitol Hill for ending the shuttle program outright.

At a minimum, engineers once again confronted questions about the shuttle's basic fitness: Is it simply impossible for the huge spacecraft, built of 2 million parts with 1970s technology of byzantine complexity, to withstand the forces of launch?

NASA officials, however, stood by their longtime workhorse.

"We think the vehicle is safe, and we think we can make it safe," shuttle program manager William W. Parsons told reporters. "We feel extremely confident in our vehicle."

But the question circulating in the space community was this: If making the shuttle safe required months or even years more effort, why not abandon it altogether, take the money and build something new, even though the space station probably could not endure years more in orbit without a heavy-lift spaceship to resupply it?

"I don't think anyone is going to let Griffin quit the program," said an industry source who spoke on the condition of anonymity. "The shuttle is part of the president's initiative, and he has signed on to advance it."

Griffin was not known as a strong shuttle or space station booster before his appointment early this year, but he offered support for the program Wednesday, saying in a statement that "we will closely and thoroughly evaluate this event and make any needed modifications to the shuttle before we launch again."

But he also focused on the need to know what happened to the external tank.

"We have said repeatedly that the first two flights in our return-to-flight sequence are test flights," Griffin's statement said. "Among the things we are testing are the integrity of the foam insulation and the performance of new camera equipment installed to detect problems. The cameras worked well. The foam did not."

The large debris fragment, clearly visible on videotape taken from a camera on the external tank, broke away from a thick foam ridge that serves to curtail air turbulence around the tank's external electric cables and pressure lines during launch.

The debris chunk was a trapezoidal piece of foam as much as 33 inches long, 13 inches wide and eight inches thick, NASA analysts said later, considerably smaller than the 1.67-pound fragment that doomed Columbia, but well above the 0.023-pound size deemed acceptable in the aftermath.

Hale said the small fragment that may have hit the orbiter's wing came from an area very close to where the large fragment had been, but broke away 20 seconds later -- "a long time" during a shuttle launch.

"Is there a correlation?" asked one industry source who spoke on the condition of anonymity because he was not speaking for his company. "There's a common environment as far as location, but they may be dealing with a completely different set of physical parameters.

"Nobody has a clue," he added. "There's a lot of work to do to place this in the right set of circumstances, and then you have to abandon all assumptions. It's way too early to predict how long this is going to take."

Hale said engineers had rejected several new methods of applying the foam to the "protuberance air load ramp": manual application, a manual alternative, or even replacing the foam ramp with metal.

Shannon said NASA had also considered getting rid of the ramp, and ran some wind tunnel tests to try the idea.

"That was no good," he said. The ramp was needed to screen the cables and pressure lines. "So we looked at the history of the ramp, and it had had very few problems.

"We built a pretty good set of rationales to fly," Shannon said. It was easy to apply foam manually to the ramp, and easy to check the job, because the ramp could be X-rayed to check for "voids" that could pop foam off during launch.

But the rationales were wrong: "This is a very serious situation," Shannon said. "We have to fix it before we can fly."