Excellent question. I was wondering the same thing.
It seems like it must be two engines that aren't in the same pair. If two engines in the same pair went, you'd have to cut off the opposite two to maintain symmetry, and then you're down four. If it could handle losing four engines, you'd think he would have said that....
On the other hand, maybe they can lose four engines as long as their opposite each other, and he didn't say that because it's not any four. It's not completely implausible. If each engine runs at 50% normally, then increasing the remaining four to 100% would give you the same thrust. Attitude control would be the big challenge, but perhaps smaller thrusters are able to handle it.
Edit: I just realized that the landing thrusters double as the launch escape system. The LES needs really high thrust to get the fragile meaty cargo as far away from the exploding rocket as quickly as possible. The Soyuz LES produces accelerations of well over 10 gees, for example. If these engines are capable of that, then they must have huge margins, as far as thrust goes, for landing. Looking over reports, I must have missed it in the stream, but Musk said that each one generates 16,000lbs of thrust. While the capsule as a whole weighs well under that... and it has eight engines. It also looks like the engine pairs are angled apart somewhat, which should allow for some control even on only two opposite pairs. I'm going to go ahead and guess that it can tolerate losing any two engines, and up to four if it's lucky about which ones it loses.
Yup, same engines. The escape system is an integral part of the vehicle (rather than a bolt on system as with tractor abort) and is regularly used and tested. And because the escape system is always there it means they can abort at any point during launch all the way up to orbit, which is fairly unprecedented. I believe they can generate 8 gees of thrust with the escape system which would allow them to escape even if the rocket doesn't get shut down during an abort.
As jcooper said you can lose two engines from the same pair. The pairs of engines are in a rectangle configuration not a square. This asymmetry allows you to compensate for a missing pair by using some combination of the the other 3 pairs.
It seems like it must be two engines that aren't in the same pair. If two engines in the same pair went, you'd have to cut off the opposite two to maintain symmetry, and then you're down four. If it could handle losing four engines, you'd think he would have said that....
On the other hand, maybe they can lose four engines as long as their opposite each other, and he didn't say that because it's not any four. It's not completely implausible. If each engine runs at 50% normally, then increasing the remaining four to 100% would give you the same thrust. Attitude control would be the big challenge, but perhaps smaller thrusters are able to handle it.
Edit: I just realized that the landing thrusters double as the launch escape system. The LES needs really high thrust to get the fragile meaty cargo as far away from the exploding rocket as quickly as possible. The Soyuz LES produces accelerations of well over 10 gees, for example. If these engines are capable of that, then they must have huge margins, as far as thrust goes, for landing. Looking over reports, I must have missed it in the stream, but Musk said that each one generates 16,000lbs of thrust. While the capsule as a whole weighs well under that... and it has eight engines. It also looks like the engine pairs are angled apart somewhat, which should allow for some control even on only two opposite pairs. I'm going to go ahead and guess that it can tolerate losing any two engines, and up to four if it's lucky about which ones it loses.