When performing a controlled shutdown of an N node cluster, start with a graceful shutdown of the node with the highest node number (usually number 3) and wait until the node is fully shut down before proceeding with the next one. This ensures that the quorum is kept as long as possible and in the end node 1 is the most up to date node.