1. Oracle didn't shutdown because other two control files were still available.

2. That is the feature in Oracle; If one control file fails or lost it continues to write to other control files.

3. It writes parallaly to the control files however redo log files are used in a cyclic manner.

4. If you have more than one control files (and you should always have it) nothing will happen to Oracle if it fails to write to one control file. You can just copy the good contol file after shutting down the database.

Sanjay