It is a standard inter-NB Xn procedure. It is not possible to get a 100% offset (handover margin) in real life. It is possible in NetSim. Yes, A3, it is based on the event.
NetSim implements on those aspects of the 5G handover procedure that directly affects network performance. Other aspects of the handover, for example security, are either not implemented or abstracted since they do not affect network performance.
The packet flow (which can be observed from the packet trace) is as follows:
1. Once the UE connection and association procedures are completed, the UE sends a UE_MEASUREMENT_REPORT every UE_Measurement_Report_Interval to the connected gNB. UE_Measurement_Report_Interval is by default set as 120ms in NetSim and is a user configurable parameter.
2. At some time, neighbor cell RSRP (measured as SNR in NetSim) becomes offset higher than serving cell RSRP.
3. Immediately after receiving the next UE_MEASUREMENT_REPORT, source gNB (also sometimes called serving gNB) sends a HANDOVER REQUEST to the target (neighbor) gNB. This packet is sent through the Xn interface via a 5G-Core Switch. All the links in the 5G Core are by default 10 Gbps.
4. The Target gNB sends back HANDOVER REQUEST ACK to serving gNB, again via the Xn interface.
5. After receiving HANDOVER REQUEST ACK the serving gNB sends the HANDOVER COMMAND to UE
6. After the HANDOVER COMMAND packet is transferred to the UE, the target gNB will send the PATH SWITCH packet to the AMF through the N1-N2 interface (via a core switch).
7. When the AMF receives the PATH SWITCH packet, it sends MODIFY BEARER REQUEST to the SMF. This is over the N11 interface.
8. The SMF on receiving the MODIFY BEARER REQUEST sends back the MODIFY BEARER RESPONSE to the AMF.
9. On receiving the MODIFY BEARER RESPONSE from the SMF, AMF acknowledges the Path switch request sent by the target gNB by sending the PATH SWITCH ACK packet back to the target gNB. This is over the N1-N2 interface, via a 5GC switch.
10. The target gNB the sends a UE CONTEXT RELEASE to source gNB, and the source gNB sends back UE CONTEXT RELEASE ACK to target gNB. The context release request and ack packets are sent between the source and target gNB via the Xn interface.
11. Then RRC Reconfiguration takes place between target gNB and UE. Target gNB then becomes source gNB.
12. UE starts sending the UE MEASUREMENT REPORT to the new source gNB
Per 3G PP handover latency can be measured by the time UE received handover command from the source cell and it sends RRC Connection Reconfiguration Complete to the target cell. This can be modeled in NetSim. I don't think the GUI support NSA to SA handover (inter-RAT) but it can be done by modifying the config file.
This can be quite easily simulated. Set up two BSs and place the UE near the cell edge. You can make it move along the cell edge (think of the side of a hexagon). Then enable shadow-fading in both BSs. Because of SF the propagation losses will vary and hence you will be able to see the UE getting handed over in a ping-pong fashion between the BSs.