1. The Attack Table
So, firstly, we look at how attacks on WoW are calculated. WoW uses what's called a single roll system, so basically, when you or a mob attacks, a single random number is generated and the results of the attack are determined based on that. Think of it like rolling a dice. Say, for example, you have a 1/6 chance to be missed, you have a 1/6 chance to dodge and a 1/6 chance to parry. If you roll a 1, the attack is a miss, if you roll a 2, the attack is dodged, if you roll a 3, the attack is parried. Anything else and the attack lands.
This might seem unimportant but it has two very important results.
Firstly, avoidance is additive, not multiplicative. One of the common mistakes people make in coming into the game is getting that wrong. What's the difference? Well, if it were multiplicative, it would mean that first the game would calculate if the attack was missed. If it wasn't, it would then calculate if the attack was dodged. If it wasn't, it would then calculate if the attack was parried. This results in a different total avoidance to what it actually is. For the maths, you'd get
Avoidance total = (1 - (1 - dodge) x (1 - parry) x (1 - miss)
This is wrong. Don't use this. To get your total avoidance, you can simply add your avoidance stats together. Which leads to the second very important result: It's possible to become what is referred to as "unhittable". Now, to clear up some confusing terminology here, it does not mean you take no damage. It means you're never "hit". Which sounds confusing, so let's look at the attack table!
The attack table is filled out in that order, from top to bottom. Now, criticals are kept in for the sake of completion here (I've left out a few things that tanks need never worry about, such as glancing or crushing blows) but against bosses, the critical chance is always 0% provided you've specced correctly. There are mobs, however, who can crit despite having those talents but that's not going to be covered in this thread.
It's worth noting here that player attacks use the same sort of attack table. (Which means hit/exp doesn't make Savage Defense proc more)
So, to fill out the table with some generic avoidance stats, we get this:
Anyone who's done any basic maths knows a list of percent chances needs to add up to 100, so whatever's not avoidance is chance to be fully hit:
This is where being unhittable comes in. If you can increase your avoidance stats high enough, usually by stacking a lot of block, you can reduce your chance to be fully hit to 0%. At this point, you're unhittable.
It's worth pointing out here, that mobs higher levelled than you have an innately higher chance to hit. It works out to be a 0.2% decrease to each avoidance stat per level above you, so for warriors and Paladins, 0.8% total per level, DKs have 0.6% total per level and druids have 0.4% total per level. However, only shield tanks are ever going to reach unhittable because of how diminishing returns work, since bosses are 3 levels above you, so you actually need to get your avoidance to add up to 102.4%, not 100%. (Thanks Mnemoniq for clarifying this)
There's another thing you might notice: Dodge and parry are above block. This makes sense really, because dodging and parry an entire attack are preferable to blocking part of an attack, but it does mean that if your dodge, miss, parry and block add up to more than 102.4%, your block chance is decreased and you wind up with wasted block chance that does nothing. This is usually referred to as the block cap (Warriors have a soft and hard cap to worry about, the soft cap being 102.4% with Shield Block up)
So the way this works in combat is similar to the dice roll I mentioned earlier. Every time a monster hits you, the computer calculates a random number between 0.00% and 100%, then based on that, looks up what that number corresponds to in the attack table and then does whatever with it. So, say, if it rolls a 3.67%, that becomes a miss. If it rolls a 17.91%, it becomes a dodge and so on.
This does bring up another question though, of where do absorbs (including Savage Defense and Blood Shield) lie? They're a unique case that's calculated after the attack table. If it's a miss, no damage is done to be absorbed, if it's blocked, only the reduced hit is absorbed. Critical block works similarly. After you block, it rolls again to see if it's a crit.