An attack roll is made for each attack performed by a creature. The attacker rolls a d20 and adds his attack bonus to the roll. If this sum is equal to or greater than the defender's armor class, then the attack hit hard enough to inflict damage, unless negated by some other consideration. An attack that hits hard enough to inflict damage will always score at least one point of physical damage (before applying damage reduction et al.) even if the damage roll fails to produce a positive number.
An unmodified die roll of 20 always hits, and an unmodified roll of 1 always misses, regardless of the defender's armor class. An unmodified die roll in the wielded weapon's threat range has the potential to be a critical hit. If such a roll hits, then a second attack roll (the threat roll) is made with the same attack bonus, but without the automatic hit/miss for rolling a 20 or 1.
Attack rolls can be negated by concealment, miss chance, parry, deflect arrows, and epic dodge. Threat rolls can be negated only by parry.